Are scripts coded only using the default API of a high level, interpreted language for generic and meticulous gathering of network device and host software information that are already available through common network security applications able to go unnoticed at times that common network security applications would set off alarms from packet inspection?
A packet is a packet is a packet. There is no difference no matter how you generate it, be it using a tool like scapy or using a scripting language like Python or Ruby.
What matters is the frequency and contents of the packets you are sending out. For example, a IDS might get suspicious if you are hitting the system with multiple
SYN packets on multiple ports, which is what happens if you use the default
-sS flag on
nmap. What a scripting language will allow you do to is specify exactly how many packets you want to send out how many times. This is a very flexible option that allows you to craft out your scans in a very fine-grained manner to avoid detection.
Of course, a tool like
nmap has many options, including but not limited to the
--max-retries flags that allow you to tune the scanning frequency. This may or may not be enough depending on the exact situation.