NMAP (2)

TCP FIN scan Closed ports reply to FIN with RST Not reliable. (very) old sites won't notice nmap -sF 192.168.0.1

Fragmented scan Uses a fragmented TCP header Doesn't always work nmap -sS -f 192.168.0.1

Reverse IDENTD scan if identd is running, requests the owner of a running daemon nmap -I 192.168.0.1