A thoroughly written paper that covers the discussion of SYN, FIN, Null, Xmas, Idle, and Zombie scanning. It gives strong compare and contrast insight on methodologies to use when determining open ports on a host and remote operating system detection. It shows example scans and discusses IP enumeration along with the utilization of tools like hping2 and nmap to dig deeper.
You can download it from the following link: https://packetstormsecurity.com/files/download/32221/Low-Level_Enumeration_With_TCP.txt
Source: https://packetstormsecurity.com/files/32221/Low-Level_Enumeration_With_TCP.txt.html