If an attacker decides to implement a less obvious port-scan, or stealth attack, which of the following techniques would be appropriate to make their activities more difficult to detect?
Based on the information provided within the question it can be said that the best course of action in this scenario would be to limit their scan speed. This will slow down the progress of the attack and at the same time allow you to verify where the attack is coming from and choose a course of action in order to stop the attack completely.
