CEH Footprinting, Reconnaissance and Scanning Practice Question

During a penetration test, a security analyst observes that Nmap SYN scans to a target server are not returning any results, but TCP connect scans succeed. The server is running an IDS. Which evasion technique is the analyst MOST likely encountering?

⚠ Common exam trap

A common mix-up: candidates assume a firewall is blocking the SYN packets, but the question specifies an IDS is running, and the key distinction is that a firewall would block both scan types, while an IDS can selectively drop only half-open SYN packets to evade detection.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The IDS is dropping packets with the SYN flag set

The IDS is configured to drop packets with only the SYN flag set, which is the hallmark of a SYN scan. This evasion technique forces the attacker to use a full TCP connect scan (which completes the three-way handshake) to bypass the IDS detection. The IDS drops the initial SYN packet, preventing the scan from receiving any response, while a full connect scan is allowed because it mimics legitimate traffic.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The IDS is dropping packets with the SYN flag set
Why this is correct
An Intrusion Detection System (IDS) can be specifically configured to identify and drop packets that only contain the SYN flag, a common characteristic of a SYN scan (half-open scan). This allows the IDS to detect and mitigate reconnaissance attempts without disrupting legitimate full TCP three-way handshakes, which are typical of a TCP connect scan. Therefore, SYN packets from a SYN scan would be dropped, while the full handshake of a connect scan might be permitted to proceed.
✗
The server is using a firewall that blocks all inbound SYN packets
Why it's wrong here
If a firewall were configured to block all inbound SYN packets, it would prevent both SYN scans and TCP connect scans from establishing a connection. A TCP connect scan, despite completing the three-way handshake, still initiates with a SYN packet. Consequently, blocking all SYN packets would indiscriminately prevent any new TCP connection attempt, making it impossible for a connect scan to succeed where a SYN scan fails.
✗
The analyst's packets are being fragmented, causing them to be dropped
Why it's wrong here
Packet fragmentation, often used as an evasion technique, involves splitting larger packets into smaller pieces. If fragmentation were causing packets to be dropped, it would likely affect both SYN scan packets and the initial SYN packets of a TCP connect scan similarly. There is no inherent mechanism for a network device to selectively drop only fragmented SYN scan packets while allowing fragmented connect scan packets to pass, making this an unlikely explanation for the observed selective blocking.
✗
The target is using a honeypot that responds to all connection attempts
Why it's wrong here
A honeypot is designed to attract and deceive attackers by simulating vulnerable systems and services, typically responding to all connection attempts regardless of the scan type. If the target were a honeypot, it would respond to both SYN scans and TCP connect scans, providing a simulated service or error. It would not selectively cause SYN scans to fail by dropping packets while allowing connect scans to succeed.

Visual reference

Go deeper

CEH Footprinting, Reconnaissance and Scanning Practice Question

Why each option matters

Option-by-option breakdown

Related to this question