CEH Footprinting, Reconnaissance and Scanning Practice Question

Which THREE of the following are valid Nmap flags that can be used to evade detection by an IDS? (Select exactly 3.)

⚠ Common exam trap

EC-Council often tests the misconception that -sS is an evasion technique, but it is actually a stealth scan that reduces connection logging, not IDS evasion; the real evasion flags are those that alter packet structure or source identity.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

-D

(-D) is correct because the decoy scan flag allows you to spoof multiple source IP addresses, making it difficult for an IDS to distinguish the real scanning host from the decoys. This technique floods the target with scan traffic from many IPs, obscuring the true origin and evading detection.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
-O
Why it's wrong here
The -O flag in Nmap is used for operating system detection, which involves analyzing various TCP/IP stack characteristics to identify the target's OS. While crucial for reconnaissance, this function is about *identifying* the remote system, not *evading* detection of the Nmap scan itself. It provides information to the attacker, rather than obfuscating the attacker's presence or scan traffic from network defenses.
✓
-D
Why this is correct
The -D <decoy1,decoy2,ME,...> flag initiates a decoy scan, which is a powerful evasion technique designed to obscure the true source of the Nmap scan. By sending packets from multiple spoofed IP addresses alongside the real scanner's IP, it makes it significantly harder for Intrusion Detection Systems (IDS) and firewalls to pinpoint the actual origin of the scan activity. This creates a smokescreen, distributing the apparent attack source across numerous hosts and complicating forensic analysis.
✓
-f
Why this is correct
The -f flag enables packet fragmentation, an evasion technique that breaks down Nmap's probe packets into smaller, non-standard fragments. This method aims to bypass basic firewall rules and Intrusion Detection Systems (IDS) that might struggle to correctly reassemble or inspect fragmented packets for malicious signatures. By splitting TCP headers and other data across multiple IP fragments, it can make signature-based detection more challenging, as the full malicious pattern might not be present in any single fragment.
✗
-sS
Why it's wrong here
The -sS flag specifies a SYN scan, also known as a half-open scan, which is a common and relatively stealthy port scanning method. This technique sends only the initial SYN packet and waits for a SYN/ACK response, never completing the three-way handshake, thus avoiding full connection logs on the target. While stealthier than a full TCP connect scan, it is fundamentally a *type of scan* for discovering open ports. It does not employ methods to hide the scanner's identity or obfuscate the scan traffic from network monitoring tools, distinguishing it from true evasion techniques.
✓
--data-length
Why this is correct
The --data-length <number> flag instructs Nmap to append a specified amount of random data to the end of sent packets. This technique is used for evasion by altering the size and content of the packets, making them deviate from standard or expected patterns. By adding arbitrary bytes, it can confuse signature-based Intrusion Detection Systems (IDS) that rely on precise packet length or content matching, potentially allowing the scan traffic to bypass detection.

Go deeper

CEH Footprinting, Reconnaissance and Scanning Practice Question

Why each option matters

Option-by-option breakdown

Related to this question