The trick is to use SOCK_RAW to do the dirty work. You can formulate your own packets here, sans protocol. You should look at examples like traceroute.c for inspiration, and should also have a full understanding of both IP and the UNIX socket architecture. Otherwise, this will be an exercise in futility.

I would suggest that a better approach is to interface Perl with NMAP which does everything you want, and then some, and has the advantage of already being implemented and tested.