why an attacker typically uses an ack scan to bypass a firewall
An adversary uses TCP ACK segments to gather information about firewall or ACL configuration. ... Getting RSTs back in response to a ACK scan gives the attacker useful information that can be used to infer the type of firewall present. Stateful firewalls will discard out-of-sync ACK packets, leading to no response.