Snort’s sfPortscan preprocessor identifies stealthy "half-open" (SYN) and specialized scans (FIN, NULL, Xmas) by generating actionable "pseudo-packets" containing key attack data like IP/port ranges, priority counts, and connection counts. This feature allows for the detection of reconnaissance activities designed to bypass traditional logging. For more information, visit the Snort documentation . Port Scanning Techniques | Nmap Network Scanning