The silent prelude to the intrusion is stealthy reconnaissance scans (such as XMAS, NULL, and FIN) - subtle packets that are not detected by traditional measures. These scans in contrast to noisy port sweeps take advantage of TCP behavioral peculiarities to determine open, closed, or filtered...