What are the drawbacks of a stealthy port scan?

Question

I read that port scanning services like nmap will conduct a "TCP Connect Scan". They'll attempt to make a TCP connection to each of the ports within the range provided. But because each of these connections will be logged, it is easy for a system administrator to notice that someone has scanned their ports. So a more stealthy method is the "TCP SYN Scan". This method will close the connection after recieving the "SYN + ACK" packet from the server, thus it can determine which ports are open but because it doesn't complete the connection the server doesn't record it in its logs.

What are the drawbacks of the "TCP SYN Scan"? I assume there must be some drawback, if it was simply better then surely it would be the default option on nmap, but instead you need to enable it with -sS. Is it in some way less effective than a TCP connect scan?

Bonus question: In practice do servers log unsuccessful TCP connections too? (That seems like an easy way to defeat the stealth of a "TCP SYN Scan".

Answer 1

TCP SYN scan needs to create a raw socket that requires root access.

As Nmap document says:

SYN scan may be requested by passing the -sS option to Nmap. It requires raw-packet privileges, and is the default TCP scan when they are available. So when running Nmap as root or Administrator, -sS is usually omitted.

Therefore, the "TCP SYN Scan" is the default port scanning technique in Nmap when running as the root user.

Bonus question: In practice do servers log unsuccessful TCP connections too? (That seems like an easy way to defeat the stealth of a "TCP SYN Scan".

We can use a firewall to log TCP SYN scan. For example, see this plugin for Netfilter and Iptables.