When SYN scan is available, it is usually a better choice. Nmaphas less control over the high level connect callthan with raw packets, making it less efficient. The system callcompletes connections to open target ports rather than performing thehalf-open reset that SYN scan does. Not only does this take longerand require more packets to obtain the same information, but targetmachines are more likely to log the connection. A decent IDS willcatch either, but most machines have no such alarm system. Many serviceson your average Unix system will add a note to syslog, and sometimes acryptic error message, when Nmap connects and then closes theconnection without sending data. Truly pathetic services crash whenthis happens, though that is uncommon. An administrator who sees abunch of connection attempts in her logs from a single system should knowthat she has been connect scanned.