312-50 Question 265
Single answer▪ Evading IDSDuring an authorized internal penetration test, you discover that the target network uses a signature-based IDS that triggers on rapid TCP SYN scans and on common Nmap scan patterns. You still need to identify which hosts are running SSH on TCP/22 while minimizing the chance of generating IDS alerts. Which Nmap approach is the MOST appropriate for this situation?
- A
nmap -sS -p 22 10.10.20.0/24
- B
nmap -sT -A -p 22 10.10.20.0/24
- C
nmap -sS -p 22 -T1 --scan-delay 5s -D RND:5 10.10.20.0/24
- D
nmap -sU -p 22 --data-length 200 10.10.20.0/24
Show answer and explanation
Correct answer: C
Explanation
For IDS evasion during authorized testing, slowing and shaping traffic is often more effective than simply changing scan type. In this scenario, the IDS is known to detect rapid SYN scans and common Nmap patterns. The most appropriate response is to keep the scan narrowly scoped to the required service (TCP/22), reduce timing intensity with options such as -T1 and --scan-delay, and optionally use decoys to complicate source attribution. Nmap documentation describes timing templates, scan delay controls, and decoy scanning as valid features that affect scan behavior. However, these techniques do not guarantee invisibility; modern IDS/IPS platforms may still detect low-and-slow scans, SYN scans, or decoy usage through correlation and anomaly analysis. From a best-practice perspective in CEH-style scenarios, the correct answer is the one that minimizes scan noise while still accurately enumerating the required TCP service.
- A. Incorrect.
This performs a standard TCP SYN scan against port 22, but it uses Nmap's default timing behavior without any attempt to slow the scan or obfuscate the source. In the scenario, the IDS is known to trigger on rapid SYN scans and common Nmap patterns, so a normal -sS scan across a /24 is more likely to be detected.
- B. Incorrect.
This is a poor choice for stealth. A TCP connect scan (-sT) completes the full TCP three-way handshake through the operating system, making it generally noisier than a SYN scan for reconnaissance. The -A option enables aggressive features such as OS detection, version detection, script scanning, and traceroute, all of which increase traffic and signature exposure. Although it targets only port 22, the overall scan behavior is much more likely to trigger IDS alerts.
- C. Correct.
This is the best option. It still uses a SYN scan (-sS), which is efficient for checking TCP/22, but it reduces detectability by slowing the scan with -T1 and --scan-delay 5s so probes are less bursty and less likely to match rate-based IDS thresholds. The decoy option (-D RND:5) adds randomized decoy source addresses to make attribution harder and can complicate simple IDS logging or analyst review. While no method guarantees evasion, this combination best aligns with the stated need to identify SSH hosts while minimizing alerts.
- D. Incorrect.
This is incorrect because SSH typically runs over TCP port 22, not UDP. A UDP scan (-sU) against port 22 is unlikely to provide the needed result. Adding --data-length 200 pads packets with random data, which may alter signatures slightly, but it does not compensate for using the wrong transport protocol. This option reflects a common misconception that packet padding alone meaningfully solves IDS evasion regardless of scan type.