CEH Footprinting, Reconnaissance and Scanning Practice Question
A security analyst receives an alert that an external IP address is sending fragmented packets to the company's web server on port 80. The analyst suspects the attacker is using Nmap with fragmentation. Which Nmap flag is being used to fragment the probe packets?
⚠ Common exam trap
EC-Council often tests the distinction between -f (fragmentation) and --mtu (custom MTU size), leading candidates to mistakenly choose --mtu because they associate it with packet size changes, but only -f triggers fragmentation by default.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
-f
The -f flag in Nmap instructs the tool to fragment the probe packets into 8-byte or smaller fragments, making it harder for packet filters and intrusion detection systems to detect the scan. This matches the scenario where fragmented packets are sent to the web server on port 80, confirming that -f is the correct flag.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
-sI
Why it's wrong here
The -sI flag in Nmap initiates an Idle Scan, also known as a zombie scan. This advanced technique uses a "zombie" host's IP ID sequence to infer open ports on a target without sending packets directly from the scanner's IP address. It is a stealthy scanning method designed for anonymity and evading direct detection, not for manipulating packet sizes or fragmenting IP packets to bypass firewalls or IDPS.
- ✗
-D
Why it's wrong here
The -D flag enables decoy scanning, which involves sending scan packets from multiple spoofed IP addresses alongside the real scanner's IP. This technique aims to obscure the true source of the scan by making it difficult for intrusion detection systems (IDS) or firewalls to identify the actual attacker among a multitude of apparent sources. While it enhances stealth by distributing the apparent source, it does not involve breaking down packets into smaller fragments to bypass inspection.
- ✗
--mtu
Why it's wrong here
The --mtu option allows the user to specify a custom Maximum Transmission Unit (MTU) size for sent packets, which dictates the largest packet size that can be transmitted without fragmentation. While setting a smaller MTU can indirectly lead to fragmentation if the packet's total size exceeds this value, it primarily controls the maximum segment size. It doesn't explicitly instruct the scanning tool to fragment packets into multiple pieces for evasion purposes in the same deliberate manner as the dedicated fragmentation flag.
- ✓
-f
Why this is correct
The -f flag is the primary Nmap option used for IP fragmentation. When enabled, Nmap splits the IP header and the TCP/UDP header into several smaller IP packets, typically into 8-byte fragments. This technique can be highly effective in bypassing stateless firewalls or intrusion detection systems (IDS) that are not configured to reassemble fragmented packets before inspection, as they may only see the initial fragment and miss critical information in subsequent ones.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.