CEH Footprinting, Reconnaissance and Scanning Practice Question

Which THREE of the following Nmap options can be used to evade detection by IDS/IPS? (Select three)

⚠ Common exam trap

Watch out — candidates often think version detection (-sV) or OS detection (-O) are stealthy because they provide detailed information, but they actually generate more traffic and distinctive patterns that IDS/IPS easily flag.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

-f (fragment packets)

The -f flag fragments the crafted packets into smaller pieces, typically 8-byte fragments, which can bypass simple IDS/IPS signatures that expect full unfragmented packets. This technique exploits the fact that many intrusion detection systems struggle to reassemble fragmented packets in real time, allowing the scan to evade detection.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
-sV (version detection)
Why it's wrong here
Nmap's version detection (-sV) is not an evasion technique; rather, it actively sends a series of probes to open ports to determine the service and application version running. These additional, often application-layer, probes generate more network traffic and distinct signatures, making the scan significantly more detectable by Intrusion Detection Systems (IDS) and firewalls. Its purpose is detailed service identification, not stealth.
✓
-f (fragment packets)
Why this is correct
The -f (fragment packets) option is a potent evasion technique that instructs Nmap to split the TCP header across multiple, smaller IP fragments. This fragmentation can bypass rudimentary packet filtering rules and some stateful firewalls or Intrusion Detection Systems (IDS) that may struggle to correctly reassemble or inspect fragmented packets. By breaking the standard packet structure, it makes signature-based detection more challenging for network security devices.
✓
-sI (idle scan)
Why this is correct
The Nmap idle scan (-sI) is an advanced evasion technique that leverages a 'zombie' host's predictable IP ID sequence to infer open ports on a target without sending any packets directly from the attacker's IP address. The scanner sends spoofed packets to the target, appearing to originate from the zombie, and then monitors changes in the zombie's IP ID sequence. This indirect method makes the scan appear to originate from the zombie, effectively masking the true scanner's identity from the target's logs and network defenses.
✓
-D (decoy scan)
Why this is correct
The -D (decoy scan) option enhances stealth by interleaving the real scanner's IP address with several spoofed decoy IP addresses within the scan packets. This technique generates numerous source IP addresses in the target's logs and network traffic, making it exceedingly difficult for Intrusion Detection Systems (IDS) and firewalls to pinpoint the actual origin of the scan. By flooding the target with traffic from multiple apparent sources, it effectively confuses and dilutes the detection efforts of security analysts.
✗
-O (OS detection)
Why it's wrong here
Nmap's OS detection (-O) is not an evasion technique; instead, it involves sending a series of specialized TCP and UDP probes to the target to analyze the responses and fingerprint the operating system. These probes often include non-standard flags, window sizes, and options, which are distinct and easily identifiable patterns for Intrusion Detection Systems (IDS) and firewalls. While crucial for reconnaissance, the active nature and unique signatures of these probes make OS detection a highly detectable scanning method.

Go deeper

CEH Footprinting, Reconnaissance and Scanning Practice Question

Why each option matters

Option-by-option breakdown

Related to this question