How do you break into a system when every door has a guard and every window has a silent alarm? This chapter explains the network defences that protect computer systems and the tricks attackers use to slip past them unnoticed, which is a core skill tested in the CEH (312-50) exam.
Jump to a section
A simple way to picture Evading IDS, Firewalls, and Honeypots
Because a house has valuable possessions inside, homeowners install locks, alarms, and sometimes even hire security guards. This leads to a situation where a professional thief must study and bypass these protections without being detected.
Imagine a high-end estate sale. The house itself is your corporate network, full of data. The front door lock, window sensors, and motion-activated floodlights are your firewalls—they block obvious entry points. The silent alarm that alerts a monitoring company is your intrusion detection system (IDS)—it watches for signs of a break-in. The security guard who patrols the grounds is your intrusion prevention system (IPS)—he can actively stop a thief. Now, a professional cat burglar wants to steal a specific painting. He doesn't kick the front door down (that would trigger the alarm). Instead, he waits until the mailman delivers a package, slips in as the door is held open. This is traffic fragmentation or using a legitimate channel. He then crawls through a ventilation shaft, which is like tunnelling through a VPN or SSH connection to bypass the firewall. He disables the motion sensor on the painting's display case by sending a false infrared signal—this is packet manipulation or crafting a signature to fool the IDS. Finally, he finds a dummy painting with a GPS tracker, placed by the homeowner as a trap. That is a honeypot, a decoy system designed to catch thieves. The estate sale scenario maps perfectly to network defence and evasion, where each layer requires a specific, careful bypass technique.
Networks are like castles, and professionals need to understand both how the castle defends itself and how an intruder can bypass those defences. The three main castle defence systems are firewalls, intrusion detection systems (IDS), and honeypots.
First, what is a firewall? A firewall is a network security device that monitors and controls incoming and outgoing network traffic based on predetermined security rules. Think of it as a bouncer at a club. It looks at every person (data packet) trying to enter or leave and checks them against a guest list (the rule set). If the packet's source IP address, destination port, or protocol is not on the approved list, the firewall blocks it. Firewalls can be hardware appliances, software programs, or cloud-based services. They are the first line of defence, but they have limits—they cannot inspect the contents of a packet to see if it is malicious, only its header information (where it came from and where it is going).
Second, what is an intrusion detection system (IDS)? An IDS is a device or software application that monitors network traffic for suspicious activity and issues alerts when such activity is discovered. Unlike a firewall that blocks traffic, an IDS is a surveillance camera. It watches the traffic, compares it to a database of known attack signatures (like a criminal database), and shouts if it sees a match. For example, if a packet contains a known exploit code for a web server, the IDS will raise an alert. There are two types: network-based IDS (NIDS) which monitors an entire network segment, and host-based IDS (HIDS) which monitors activity on a single computer. The key limitation is that an IDS cannot stop an attack; it only warns you.
Third, what is a honeypot? A honeypot is a decoy system set up to attract attackers and study their behaviour. It looks like a real server but contains no real data. It is a fake treasure chest designed to distract pirates. The goal is to waste an attacker's time, learn their techniques, and get early warning of an attack. Honeypots can be low-interaction (emulating services like a fake web server) or high-interaction (a real operating system with fake data).
Now, how does an attacker evade these? This is where the exam gets practical. Attackers use several techniques:
Fragmentation: The attacker splits a malicious payload into small pieces. Each piece looks innocent by itself, but when reassembled at the target, they form the attack. Many IDS cannot reassemble fragments in real time, so they miss the attack.
Encryption and tunnelling: The attacker wraps their malicious traffic inside encrypted traffic like HTTPS or a VPN tunnel. The firewall and IDS see encrypted data and cannot inspect it, so it passes through unchallenged.
Source port manipulation: Many firewalls allow outbound traffic on high-numbered ports (like 1024-65535). An attacker sets their malicious traffic to come from one of these ports, bypassing rules that only block low-numbered ports.
Packet manipulation: The attacker changes the TTL (time to live) value or sets unusual flags in the TCP header. This can cause some IDS to misidentify or ignore the packet.
Insertion attacks: The attacker sends packets that an IDS accepts but the target system rejects. This confuses the IDS's state tracking, allowing the real attack to slip through.
Why does this matter? Because real networks have multiple layers of these defences. An attacker must evade the firewall to get in, then evade the IDS to avoid detection, and avoid honeypots to avoid being trapped. Understanding these evasion techniques is what separates a script kiddie from a skilled ethical hacker.
Scanning and Reconnaissance
The attacker uses tools like Nmap to discover open ports and services. Firewalls block most ports, so the attacker sends fragmented SYN packets to bypass simple packet filters. This step identifies the target's exposed surface and determines which evasion techniques will be needed.
Firewall Evasion via Source Port Manipulation
The attacker sets the source port of their packets to a commonly allowed port like 53 (DNS) or 80 (HTTP). Many firewalls allow outbound traffic from these ports without inspection, so the malicious packet passes through the firewall to the target.
IDS Evasion via Fragmentation and Encoding
The attacker splits the exploit payload into multiple small fragments and URL-encodes the content. The IDS sees only fragments of benign-looking strings and does not trigger an alert because it cannot reassemble them fast enough or inspect the encoded data.
Honeypot Detection and Avoidance
The attacker probes multiple servers on the network. A honeypot often has telltale signs: perfect uptime, no background noise, unusually fast responses, or services that are not commonly used. The attacker identifies and avoids these fake systems, focusing on real targets.
Establishing a Covert Channel Using Encryption
Once inside, the attacker sets up an encrypted tunnel (SSH or HTTPS) to a command-and-control server. All further malicious commands and data exfiltration are encrypted inside this tunnel. Both the firewall and IDS treat this as legitimate encrypted traffic and allow it through without inspection.
A medium-sized e-commerce company, 'ShopNow', hires an ethical hacker to test its defences. The hacker knows ShopNow uses a stateful inspection firewall at the network perimeter and a signature-based NIDS on the internal network. They also suspect a low-interaction honeypot is running on a fake database server.
Step one: Reconnaissance. The hacker uses Nmap to scan for open ports. The firewall blocks most ports, but port 443 (HTTPS) is open. The hacker sends a fragmented TCP SYN scan, splitting the SYN packet into two fragments. The firewall lets both fragments through because each fragment has a valid destination port 443. This is fragmentation evasion.
Step two: Bypassing the IDS. The hacker knows the NIDS has signatures for SQL injection attacks. Instead of sending 'SELECT * FROM users', they send it URL-encoded and split across multiple packets: 'SEL' in packet 1, 'ECT *' in packet 2. The NIDS does not reassemble the fragments fast enough and sees only benign looking strings. This is fragmentation and encoding evasion.
Step three: Avoiding the honeypot. The hacker notices a server responding on port 3306 (MySQL) but with an unusually fast response time. Real MySQL servers take 1-2 seconds to respond; this one responds in 10 milliseconds. That is a honeypot. The hacker ignores that server and targets a different one on an obscure port that is not advertised anywhere—real systems often have services on non-standard ports that are not part of the honeypot.
Step four: Maintaining access. Once inside, the hacker does not want the IDS to alert on their command-and-control traffic. They establish an SSH tunnel outbound to a cloud server. All malicious commands are encrypted inside the tunnel. The firewall sees outbound SSH traffic (port 22), which is usually allowed, and passes it. The IDS sees encrypted data and cannot detect the malicious commands inside.
What the IT professional actually does here: they run penetration testing tools like Metasploit with its evasion modules. They use tools like 'msfvenom' to generate payloads that avoid common IDS signatures. They test fragmentation with tools like 'fragroute'. They also validate that firewalls are properly configured to block fragmented packets if possible, and that IDS systems are tuned to reassemble fragments before analysis.
Real-world tips from professionals:
Always test firewall rules manually with a simple ping sweep first.
Use Wireshark to capture and analyse your own traffic to see how it looks to the IDS.
Practise evasion techniques on your own lab with Snort (a free IDS) before trying them on a client network.
Remember that encrypted traffic (HTTPS, SSH) is the most reliable way to bypass both firewalls and IDS, but it leaves log entries that can be traced back.
The 312-50 exam tests your understanding of how these defences work and how to bypass them. Expect 8-12 questions on this topic across the full exam. The questions fall into four patterns:
First, definition and identification questions. You will be given a scenario and asked to identify which defence is in use. For example: 'A security team deploys a system that monitors network traffic and sends alerts when it detects a known attack pattern. What is this system?' The answer is 'intrusion detection system (IDS)', not intrusion prevention system (IPS) because IPS actively blocks, while IDS only alerts. The trap: they might list 'firewall' or 'honeypot' as options, so you must know the exact role of each.
Second, evasion technique recognition. You will see a description of an action, like 'An attacker sends a malicious payload split across multiple packets to avoid signature matching.' The correct answer is 'fragmentation attack' or 'packet fragmentation'. They love to test fragmentation because it is a classic technique. Another common one: 'An attacker uses port 443 to send malicious commands to a compromised server?' The answer is 'tunnelling over HTTPS'.
Third, honeypot classification. They will ask: 'What type of honeypot emulates only specific services and does not allow full system interaction?' The answer is 'low-interaction honeypot'. They contrast this with high-interaction honeypots. A common exam trap: they describe a honeypot as 'a system that actively blocks attacks'—that is wrong, honeypots do not block; they only monitor and deceive. Another trap: confusing honeypots with IDS. Remember: honeypots are decoys, IDS are sensors.
Fourth, firewall types and evasion. The exam loves testing the difference between packet filter firewalls, stateful inspection firewalls, and next-generation firewalls (NGFW). A packet filter only checks header fields (IP, port). A stateful firewall also tracks connection state (is this packet part of an established connection?). NGFW adds deep packet inspection (DPI). You will be asked: 'Which firewall type can be evaded by using source port manipulation?' Answer: packet filter, because it does not track state. 'Which firewall type can be evaded by using encryption?' Answer: stateful, because it allows encrypted traffic through without inspection.
Key definitions to memorise for the exam:
IDS: monitors, alerts, does not block.
IPS: monitors, alerts, and blocks.
Honeypot: decoy system for trapping attackers.
Fragmentation: splitting packets to evade signature matching.
Tunnelling: encapsulating malicious traffic in a legitimate protocol like SSH or HTTPS.
Insertion attack: sending packets the IDS accepts but the target rejects, causing IDS state desynchronisation.
Exam trap pattern: they give a list of techniques and ask which one bypasses a signature-based IDS specifically. The trick is: signature-based IDS cannot detect zero-day attacks or heavily obfuscated payloads. So the answer is 'polymorphic malware' or 'encryption with a custom key'.
Final exam tip: memorise the port numbers used for tunnelling. SSH is port 22, HTTPS is port 443, DNS is port 53. Attackers use these ports because they are almost never blocked by firewalls.
A firewall filters traffic based on header information (IP, port, protocol) and cannot inspect packet contents for malicious payloads.
An intrusion detection system (IDS) only monitors and alerts; it does not actively block traffic—that is the role of an intrusion prevention system (IPS).
Honeypots are decoy systems designed to lure attackers and study their behaviour; they do not block or prevent attacks.
Packet fragmentation splits a malicious payload across multiple packets to avoid signature-based detection by IDS that lack real-time reassembly.
Tunnelling malicious traffic inside encrypted protocols like SSH (port 22) or HTTPS (port 443) is the most reliable way to bypass both firewalls and IDS.
A signature-based IDS cannot detect zero-day attacks or heavily obfuscated payloads, making polymorphism and encryption effective evasion techniques.
The three main types of firewall are packet filter, stateful inspection, and next-generation firewall (NGFW), each with different evasion vulnerabilities.
These come up on the exam all the time. Here's how to tell them apart.
Packet Filter Firewall
Checks only packet headers (IP, port, protocol)
Does not track connection state
Vulnerable to source port manipulation
Stateful Inspection Firewall
Also checks connection state (e.g., SYN, SYN-ACK, ACK sequence)
Tracks whether packet is part of an established connection
Vulnerable to encrypted tunnelling
Signature-Based IDS
Compares traffic to a database of known attack patterns
High accuracy for known threats
Cannot detect zero-day attacks
Anomaly-Based IDS
Builds a baseline of normal traffic and flags deviations
Can detect unknown threats
Prone to false positives
Low-Interaction Honeypot
Emulates only specific services (e.g., fake web server)
Limited risk of compromise
Less realistic, easier to detect
High-Interaction Honeypot
Runs a full real operating system with fake data
Captures detailed attacker behaviour
Higher risk if the attacker escapes the honeypot
Fragmentation Evasion
Splits malicious payload across multiple packets
Evades signature-based IDS that lack reassembly
Ineffective against stateful IDS with reassembly
Encryption Tunnelling
Wraps malicious traffic inside encrypted protocol (SSH, HTTPS)
Evades both firewalls and IDS by hiding content
Requires a separate command-and-control server
Mistake
A firewall blocks all malicious traffic automatically.
Correct
A firewall only blocks traffic based on pre-configured rules. It cannot inspect the contents of a packet to determine if it is malicious; that is the job of an IDS or IPS. Many attacks use allowed ports (like 443 for HTTPS) to bypass firewalls.
This is common because people overestimate firewall capabilities. They think 'firewall' means 'total security', but it is just a filter on header information, not a content inspector.
Mistake
An IDS and an IPS are the same thing.
Correct
An IDS only monitors and alerts; it does not take action. An IPS can block traffic in real time. The 'P' stands for 'Prevention', meaning it actively stops the attack.
The names are confusingly similar, and both involve monitoring network traffic. Beginners often swap the roles, leading to wrong answers in the exam when asked about response actions.
Mistake
Honeypots are used to directly block attacks.
Correct
Honeypots are decoys that do not block anything. Their purpose is to attract attackers, waste their time, and gather intelligence. Blocking is done by firewalls and IPS.
The word 'defence' or 'security measure' makes people assume honeypots are proactive blockers. In reality, they are passive traps, not active shields.
Mistake
Encryption always guarantees your traffic will evade IDS.
Correct
Encryption hides the content, but not the metadata (source IP, destination IP, port, packet size, timing). An IDS can still detect anomalies based on traffic patterns, such as periodic beaconing or large data transfers to unusual destinations. Also, encrypted traffic on non-standard ports can raise alert.
The logic 'encrypted = invisible' is common because beginners focus only on content inspection. They forget that network behaviour analysis can still identify suspicious activity even with encryption.
Mistake
Fragmenting a single packet into two always evades IDS detection.
Correct
Many modern IDS and IPS can reassemble fragmented packets in memory and perform signature matching on the reassembled data. Fragmentation only evades simple signature-based IDS that lack reassembly capabilities. Stateful IDS with packet reassembly will still detect the attack.
Old textbooks and entry-level courses teach fragmentation as a surefire evasion, but real-world systems have evolved. Beginners memorise it as a universal trick without understanding its limitations.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
No. A standard firewall only looks at the packet header (IP address, port, protocol). It cannot see the data payload inside the packet. To detect viruses, you need a next-generation firewall (NGFW) with deep packet inspection or a separate antivirus system.
A network-based IDS (NIDS) monitors traffic on an entire network segment using a sensor on the network. A host-based IDS (HIDS) monitors activity on a single computer, such as file changes, system calls, and log entries.
Attackers do not use honeypots—defenders use them. A honeypot is a decoy set up by the defender to trap attackers and study their methods. Attackers try to avoid honeypots because they waste time and lead to detection.
Fragmentation splits a malicious payload into multiple smaller packets. An IDS that does not reassemble packets in real time sees each fragment as an innocent piece of data. Only when the fragments are reassembled at the target does the attack execute, by which time the IDS has already passed the traffic.
An insertion attack involves sending packets that the IDS accepts as valid but the target system rejects. This causes the IDS to maintain an incorrect state of the network connection, allowing other malicious packets to go undetected because the IDS thinks the connection is in a different state.
Yes, but with caution. A VPN encrypts all traffic between your machine and the VPN server. If the VPN server is outside the target network, the firewall sees only encrypted VPN traffic, which it usually allows. However, this is detectable if the firewall logs connections to unusual VPN endpoints. For ethical hacking, always get written authorisation before using any evasion technique.
You've finished Evading IDS, Firewalls, and Honeypots. Continue through the 312-50 study guide to build a complete picture of the exam.
Done with this chapter?