Another stealth approach is to fragment the IP datagrams within the TCP header. This bypasses some firewalls acting as "packet filters" because they cannot see a complete TCP header that can match their filter rules.
