Using different settings in a scan can be used to determine how a perimeter firewall(or any other target) handles different packets and can often identify the type of hardware or software being used...