There are indirect scanning techniques that induce and measure traffic from ordinary non-compromised hosts. When the attacker notices that he gets banned for sc

There are indirect scanning techniques that induce and measure traffic from ordinary non-compromised hosts. When the attacker notices that he gets banned for scanning he'll do that. http://nmap.org/book/idlescan.html http://nmap.org/book/idlescan.html but IIRC there are more ways than this to do it.