For external interfaces I don't see a need to avoid portscans - they're popular enough on the open internet that it's not going to attract attention or deviate much from standard traffic.
I disagree. Port scanning, even externally, can be messy and still raise flags. Most are done as a single nmap shotgun effect. It is better to obfuscate better than i've seen most do. (eg: I'ts better to do common normal port ranges (and smart variants), distributed network, over a long period time).
I think it's kind of messy, and firewalls definitely can flag it. And I think over the next year as things like Storm will be more tightly wrapped into log analysis and firewalls for real time processing. (Think smarter honey pots and smarter / real time customized pattern recognition).
Comments
For external interfaces I don't see a need to avoid portscans - they're popular enough on the open internet that it's not going to attract attention or deviate much from standard traffic.