What is an nmap xmas scan?

Nmap is a poplular port scanning program that allows a network to be checked for open ports. It is able to detect open services in a firewall and also the version of the service running on the port such as an Apache web server or Exchange mail server.

The Xmas tree scan turns on the FIN, URG, and PUSH flags, basically an advanced scan that uses different TCP protocol options in an attempt to avoid a firewall or IDS detection of the scan.

The risk from this scan is minimal, from external sources you would often see such scans as they are a part of the "noise" of the internet. Consistent scans from a similar IP source or range may indicate a more targeted fingerprinting of your services, perhaps in preparation for a more dangerous attack.