I was studying about TCP SYN (stealth) scan which involves carrying out port scan while avoiding detection. I also read that it is similar to TCP connect scan except that the last ACK packet is replaced by the RST packet. I am unable to understand why this replacement of ACK with RST makes TCP SYN scan stealth. According to me the target systems can easily record the attacker's IP address as soon as it receives SYN packet.
On searching the web, the only relevant result I got was what is the difference between open TCP scan and half-open (stealth) TCP scan? On this also, it was only mentioned that lack of ACK packet makes the connection stealth. But it doesn't explains how.
How does lack of ACK packet makes the first two phases of the three-way handshake stealth? Is it something like TCP mandates logging only when the connection is established? If so, then why?