To be able to use most of the TCP scan options, Nmap needs a privileged user (a root-level account in the Unix world or an administrator-level account in the Windows world). This is used to send and receive raw packets. By default, Nmap will use a TCP SYN scan, but if Nmap doesn't have a privileged user, it will use the TCP connect scan. The various scans used by Nmap are as follows:

• TCP connect scan (-sT): This option will complete the three-way handshake with each target port. If the connection succeeds, the port is considered open. As a result of the need to do a three-way handshake for each port, this scan type is slow and it will most likely be logged by the target. This is the default scan option used if Nmap is run by a user who doesn't have any privileges.
• SYN scan (-sS): This option is also known as half-open or SYN stealth. With this option, Nmap sends a SYN packet and then waits for a response. A SYN/ACK response means that the port is listening, while an RST/ACK response means that the port is not listening. If there is no response or an ICMP-unreachable error-message response, the port is considered to be filtered. This scan type can be performed quickly, and, because the three-way handshake is never completed, it is unobtrusive and stealthy. This is the default scan option if you run Nmap as a privileged user.

• TCP NULL scan (-sN), FIN scan (-sF), and XMAS scan (-sX): The NULL scan doesn't set any control bits. The FIN scan only sets the FIN flag bit, and the XMAS scan sets the FIN, PSH, and URG flags. If an RST packet is received as a response, the port is considered closed, while no response means that the port is open/filtered.
• TCP Maimon scan (-sM): The TCP Maimon scan was discovered by Uriel Maimon. A scan of this type will send a packet with the FIN/ACK flag bit set. BSD-derived systems will drop the packet if the port is open, and will respond with RST if the port is closed.
• TCP ACK scan (-sA): This scan type is used to determine whether a firewall is stateful or not, and which ports are filtered. A network packet of this type only sets the ACK bit. If RST is returned, it means that the target is unfiltered.
• TCP Window scan (-sW): This scan type works by examining the TCP Window field of the RST packet's response. An open port will have a positive TCP Window value, while a closed port will have a zero TCP Window value.
• TCP Idle scan (-sI): Using this technique, no packets are sent to the target by your machine; instead, the scan will bounce off to a zombie host you specify. An IDS will report the zombie as the attacker.
• Nmap also supports you in creating your own custom TCP scan by giving you the option of scanflags. The argument to that option can be numerical, such as 9 for PSH and FIN, or symbolic names. Just put together any combination of URG, ACK, PSH, RST, SYN, FIN, ECE, CWR, ALL, and NONE in any order; for example, --scanflags URGACKPSH will set the flags URG, ACK, and PSH.