I just got certified in CEH and learned A LOT about nmap and how it really manipulates the three-way-handshake to get some cool information.
I have a question about possible detection problems.
When you are sending a SYN packet, even as part of a -sS scan, does that packet carry your source IP? If so, couldn't your target record that connection attempt in the firewall log and trace the connection back to you? Or is it just an unspoken 'no duh' that you should also be spoofing your IP if you want to remind undetected? Or does namp do this automatically? Or does nothing get logged if the connection was unsuccessful and the three-way handshake not completed?