During a FIN scan, a FIN packet is sent to each port of the target. If there is no response, then the port is open, but if an RST packet is sent in response, the port is closed. The success of this type of scan depends on the target operating systems many OSs, including Windows, have changed the default behavior of their TCP/IP stacks to prevent this type of scan. How? Also, how could an intrusion detection system be configured to detect a FIN scan?