Detecting Nmap Scans: The View From the Defender's Side
The site already teaches you how to run every nmap scan. This one flips the camera around: what a SYN scan, a UDP scan and a ping sweep actually look like in an IOS XE ACL counter, in syslog and in a packet capture, plus why a slow scan beats most of it.