The TCP SYN scan, also known as a 'half-open' scan, is the default scan type when run with root or administrator privileges. It works by sending a TCP SYN packet to a target port. If a SYN/ACK packet is received, the port is considered open, and Nmap sends an RST packet to tear down the connection before it's fully established. If an RST packet is received, the port is closed. If no response is received, the port is considered filtered. This method is efficient and less likely to be logged by applications compared to a full TCP connect scan.

The TCP Connect scan is used when the user lacks the necessary privileges to craft raw packets (i.e., not running as root or administrator). It utilizes the operating system's connect() system call to establish a full TCP connection with the target port. If the connection is successful, the port is open. If it fails, the port is closed or filtered. While reliable, this method is noisier and more easily detected by network monitoring tools.

UDP ports are connectionless, meaning there's no handshake like in TCP. Nmap's UDP scan sends UDP packets to target ports. If an ICMP 'port unreachable' message is received, the port is closed. If a UDP response is received, the port is open. If no response is received, the port is considered open|filtered. Due to the nature of UDP, these scans can be slow and may require retransmissions.

Version detection (-sV) is a powerful feature that goes beyond simply identifying open ports. Nmap sends a series of probes to open ports and analyzes the responses to determine the application name, version number, and sometimes even the operating system and device type. This information is invaluable for identifying known vulnerabilities associated with specific software versions.

OS detection (-O) attempts to identify the operating system of the target host. Nmap sends a variety of TCP, UDP, and ICMP probes and analyzes the responses, looking for subtle differences in how operating systems implement the TCP/IP stack. This fingerprinting technique can accurately identify the OS, which is crucial for tailoring exploits.

The -A option is a convenient shortcut that enables OS detection (-O), version detection (-sV), script scanning (-sC), and traceroute (--traceroute). It provides a very comprehensive overview of the target but is also the noisiest and most easily detectable scan type.

FIN, Xmas, and Null scans are stealthier alternatives to SYN scans. They send TCP packets with specific flag combinations (FIN, PSH+URG+FIN, or no flags, respectively). According to RFC 793, a closed port should respond with an RST packet, while an open port should ignore these packets. If an RST is received, the port is closed; if no response is received, the port is considered open|filtered. These scans are particularly effective against older or misconfigured firewalls.

The Idle Scan (-sI) is a highly stealthy technique that uses a 'zombie' host (a host that is idle and predictable in its IP fragmentation ID increments) to perform the scan. Nmap sends probes to the target via the zombie. The zombie's response, containing its incrementing IP ID, is observed by Nmap. By analyzing these IP ID increments, Nmap can infer whether ports on the target are open or closed without directly interacting with the target from its own IP address.

NSE scripts are written in the Lua programming language and can be used to automate complex tasks. They are categorized by their functionality, such as 'discovery', 'exploit', 'vuln', and 'auth'. Using scripts like -sC (default script scan) or --script <script-name> allows for targeted information gathering and vulnerability assessment.