[mkmkmmmmm]

If you want to defend against port scanning just open some honeyports that ban all connectors. Maybe randomize these every X hours.

[bcoates]

There are indirect scanning techniques that induce and measure traffic from ordinary non-compromised hosts. When the attacker notices that he gets banned for scanning he'll do that.

http://nmap.org/book/idlescan.html but IIRC there are more ways than this to do it.