[OldWolf]

Getting a good scan is great, getting one without them finding you is better!
using nmap you can perform this task.
Reasons to do this
1. your ip does not come up in any logs on the target (will show in isp deep packet inspection)
2. your ip may be filtered by the target
3. you do not want to set off any alarms sending many network packets from the same address

useing the 'nmap -D' option you can specify the source address (example nmap -D 8.8.8.8 example.com). This would scan example.com spoofing the ip address 8.8.8.8 (googles dns server)
By putting RND in instead of a fake address, a random one is used. Furthermore adding many of these with comas to seperate them creates many fake addresses for the scan to originate from.

Last login: today 06:06:06 2014 from 1.2.3.4
user@localhost:~$ nmap -D RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND example.com

Starting Nmap 6.25 ( http://nmap.org ) at 2014-07-11 02:05 GMT Daylight Time

Nmap scan report for example.com (93.184.216.119)

Host is up (0.39s latency).

Not shown: 993 filtered ports

PORT STATE SERVICE

53/tcp closed domain

80/tcp open http

443/tcp open https

554/tcp closed rtsp

1119/tcp closed bnetgame

1755/tcp closed wms

1935/tcp closed rtmp



Nmap done: 1 IP address (1 host up) scanned in 198.00 seconds

user@localhost:~$exit


its late now time for sleep

[XERXES]

Interesting. How does this work?

[OldWolf]

This boiled down to how internet protocols connect at the most basic level.
EXAMPLE: website connection!
When you enter a address in your browser after necessary DNS requests to find the ip, your computer sends out a SYN packet to port 80(webserver port) to the web site.
The server will then send back an ACK packet to say YES the port is open.
A series of back and fore packets occure before browser connection and page veiwing....but that do not matter in this explanation.
This only uses the first 2 packets


This scan sends out a single SYN packet to a pre-set list of network ports. each SYN packet has a FROM and TO address in it.
all this does is randomize the FROM IP in all the syn packets sent.
The trick is being as the ACK is sent along the connection the original SYN is sent through the acknowledgement is seen even from a spoofed address and the connection is left hanging with no response from the spoofed address.