NMAP: More port scanning techniques

This is the guide to nmap: http://searchsecurity.techtarget.com/tip/0,289483,sid14_gci1195745,00.html

Explains how to use Nmap's:

TCP Null (option –sN), FIN (option –sF) and Xmas (option –sX) scans to get through non-statful firewalls and packet filtering routers.

IPID Idle scan (option -sI) to to map out IP-based trust relationships between machines, and get through firewalls.

TCP ACK scan (option -sA), to help map out firewall rule sets.

As well as many other ways to test firewall configurations.