CEH Footprinting, Reconnaissance and Scanning Practice Question

A penetration tester is trying to evade an IDS that detects out-of-order TCP packets. The tester uses Nmap with the -f flag. What is the PRIMARY effect of this flag?

⚠ Common exam trap

Test-takers frequently confuse the `-f` flag with decoy or spoofing techniques, but the primary effect is fragmentation to evade packet filters and simple IDS, not to hide the source IP or slow the scan.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Splits the TCP header into multiple packets to bypass simple packet filters

The `-f` flag in Nmap fragments the IP packet into smaller pieces, typically 8-byte fragments, which splits the TCP header across multiple packets. This fragmentation causes the IDS to see out-of-order or incomplete TCP headers, making it harder for signature-based detection to reassemble and match malicious patterns, thus bypassing simple packet filters that do not perform full TCP reassembly.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Splits the TCP header into multiple packets to bypass simple packet filters
Why this is correct
The Nmap -f (fragment) option instructs the scanner to split the TCP header of outgoing packets across several small IP fragments. This technique aims to bypass simple, stateless packet filters or intrusion detection systems (IDS) that only inspect the initial fragment of a packet. By distributing critical header information, such as port numbers or flag settings, across multiple fragments, a basic IDS might fail to reassemble the full packet and thus miss the malicious intent, allowing the scan to proceed undetected.
✗
Slows down the scan to avoid triggering rate-based alarms
Why it's wrong here
The action of slowing down a scan to avoid triggering rate-based intrusion detection system (IDS) alarms is typically achieved using Nmap's `--scan-delay` or `-T` (timing template) options. The `-f` option, however, specifically deals with IP packet fragmentation and has no direct impact on the rate or timing of packets sent. Therefore, while slowing a scan is a valid evasion technique, it is not accomplished through packet fragmentation.
✗
Sends packets from multiple decoy IP addresses to obscure the source
Why it's wrong here
Sending packets from multiple decoy IP addresses to obscure the true source of a scan is a distinct evasion technique implemented in Nmap using the `-D` flag. This method involves interspersing legitimate scan packets with packets originating from spoofed decoy IP addresses, making it difficult for a target to identify the actual attacker among the noise. The `-f` option, which fragments packets, serves a different purpose entirely and does not contribute to source IP obfuscation through decoys.
✗
Spoofs the source IP address to hide the attacker's identity
Why it's wrong here
Spoofing the source IP address to conceal the attacker's identity is a fundamental network attack technique, often accomplished in Nmap using the `-S` option or as part of a decoy scan. This involves replacing the legitimate source IP in the packet header with a fabricated one, making it appear as if the scan originates from a different host. Packet fragmentation, controlled by the `-f` option, modifies the structure of IP packets but does not alter the source IP address itself, thus it does not directly hide the attacker's identity.

Go deeper

CEH Footprinting, Reconnaissance and Scanning Practice Question

Why each option matters

Option-by-option breakdown

Related to this question