CEH Footprinting, Reconnaissance and Scanning Practice Question

During a penetration test, a tester uses Nmap with the command: nmap -sS -D RND:10 192.168.1.100. After the scan, the IDS logs show multiple SYN packets from different source IPs hitting the target. However, the tester's true IP is not among them. Which of the following techniques is being used?

⚠ Common exam trap

Watch out — candidates often confuse decoy scans with idle scans, as both involve spoofed IPs, but idle scans require a zombie host and IPID manipulation, while decoy scans simply flood the target with fake sources to hide the real one.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Decoy scan

The command `nmap -sS -D RND:10` performs a SYN stealth scan with 10 randomly generated decoy IP addresses. The IDS logs show multiple SYN packets from different source IPs, but the tester's true IP is not among them because Nmap sends the decoy packets with spoofed source addresses while the real scan packet is interleaved among them. This is the definition of a decoy scan, which aims to obscure the attacker's true origin by blending it with fake sources.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Idle scan
Why it's wrong here
An Idle scan, specified by the -sI flag, leverages a "zombie" host to send scan packets on behalf of the attacker. The attacker monitors the zombie's IP ID sequence to infer open ports on the target without directly sending packets from their own IP. This technique is distinct from using the -D flag, which explicitly adds decoy source IP addresses to obfuscate the true origin of the scan, making it the incorrect answer for a command utilizing -D.
✗
SYN flood
Why it's wrong here
A SYN flood is a denial-of-service (DoS) attack where an attacker sends a high volume of SYN requests to a target server but never completes the three-way handshake. This exhausts the server's resources by filling its connection table with half-open connections, making it unable to respond to legitimate requests. This is fundamentally different from a port scanning technique, which aims to discover open ports and services, and does not involve the sustained, high-volume, uncompleted connection attempts characteristic of a flood.
✓
Decoy scan
Why this is correct
A Decoy scan, initiated with the -D flag, is a technique used to obfuscate the true source IP address of the scanner by interspersing it with multiple decoy IP addresses. When RND:10 is used, Nmap generates 10 random, non-existent IP addresses (or existing ones if specified) and sends scan packets from these decoys, along with the actual scanner's IP. This makes it challenging for intrusion detection systems (IDS) or firewall logs to pinpoint the actual origin of the scan amidst the noise generated by the decoys.
✗
Fragmentation attack
Why it's wrong here
A fragmentation attack, typically invoked with the -f or --mtu Nmap flags, involves splitting scan packets into smaller, fragmented IP packets. This technique aims to evade stateless firewalls and intrusion detection systems (IDS) that might only inspect the first fragment of a packet, potentially missing malicious content or scan signatures in subsequent fragments. This method focuses on manipulating packet structure, which is distinct from the decoy scan's approach of spoofing source IP addresses to hide the scanner's identity.

Visual reference

Go deeper

CEH Footprinting, Reconnaissance and Scanning Practice Question

Why each option matters

Option-by-option breakdown

Related to this question