This technique is often referred to as half-open scanning, because you don't open a full TCP connection. You send a SYN packet ... If bypassing a firewall is your goal, scan the target network for port 21 (or even for any FTP services if you scan all