Quick background (1–2 lines)
XMAS/NULL/FIN scans send TCP packets with unusual flag combinations (XMAS = FIN+PSH+URG, NULL = no flags, FIN = FIN-only) to infer port state by observing responses (or silence). Modern stacks and middleboxes make simple inference unreliable — but probes still...