Malicious intruders use literally hundreds of methods and tools
when they attempt to compromise PCs. The following are some the
most common attacks:  Port scan. To attack a PC, an intruder
must determine which TCP or UDP ports (and thus services and
programs) are open on that computer. Each program that connects
to or accepts connections from the Internet is assigned an IP
port number (0 to 65536). Port numbers often indicate a
particular type of service. For example, Internet email often
uses port 25 for SMTP or port 110 for POP. If you go to an FTP
site to download files, your computer uses port 20 or 21.
Intruders often scan (connect to multiple ports) victim
computers to see which ports are active. After they identify the
open ports, intruders (or their malicious programs) narrow down
future attacks to a particular port type. Firewalls should
notice this activity because it’s unusual for a remote computer
to connect to more than a few ports at one time.  Network
traffic flood. The principle behind network