FIN scans, as NULL, XMAS, or custom-flags scans --were and--are used for bypassing firewall and sometimes evading IDS, I quote: FIN Scan: The key advantage to these scan types is that they can sneak through certain non-stateful firewalls and packet filter