With the use of halfopen ports and sending SYNC (sometimes additional flags like FIN) one can scan behind a firewall. And it shouldnt let the site feel were scanning by not doing a 3-way-handshake we hope to avoid any tcp-logging.