312-50 Question 266
Single answer▪ Evading IDSDuring an authorized internal penetration test, you need to verify whether a network IDS is detecting your reconnaissance activity against a Linux web server in the same subnet. A baseline Nmap SYN scan (-sS) triggered IDS alerts almost immediately. You want to reduce the chance of signature-based detection while still obtaining useful TCP port information in a controlled, low-volume manner. Which Nmap technique is the MOST appropriate to try next?
- A
Use a fragmented packet scan with Nmap's -f option
- B
Switch to a full TCP connect scan using -sT
- C
Increase scan speed with -T5 to complete before the IDS can react
- D
Use aggressive OS and version detection with -A to blend reconnaissance into normal traffic
Show answer and explanation
Correct answer: A
Explanation
The best answer is packet fragmentation with Nmap's -f option. In practical CEH-style scenarios, when a SYN scan is detected by a signature-based IDS, a tester may try fragmentation to alter packet structure and evade simplistic inspection engines. However, this is only a partial evasion technique: modern IDS/IPS solutions such as Snort- or Suricata-based deployments commonly perform fragment reassembly, so fragmentation should not be assumed to work reliably. Nmap documentation describes -f as a packet fragmentation feature intended to split headers across packets, and CEH objectives commonly treat fragmentation as a classic IDS evasion method. By contrast, -sT is generally noisier, -T5 increases scan aggressiveness, and -A adds conspicuous probes. Best practice in authorized testing is to combine low-and-slow timing, minimal necessary probes, and controlled validation of defensive detections rather than relying on a single evasion flag.
- A. Correct.
Correct. Nmap's -f option fragments probe packets into smaller IP fragments, which can sometimes make simple packet-filtering or signature-based IDS devices less effective at matching full scan signatures. In CEH context, packet fragmentation is a classic IDS evasion technique. It is not guaranteed to bypass modern IDS/IPS platforms because many reassemble fragments before inspection, but among the listed options it is the most appropriate next step for reducing signature-based detection during a cautious TCP reconnaissance attempt.
- B. Incorrect.
Incorrect. A TCP connect scan (-sT) completes the full three-way handshake through the operating system's networking stack, making it more visible in logs and often easier for IDS and host-based monitoring tools to detect than a SYN scan. It is typically used when raw packet privileges are unavailable, not as a preferred IDS evasion method.
- C. Incorrect.
Incorrect. Increasing timing to -T5 makes the scan faster and noisier, which generally increases the likelihood of triggering threshold- or behavior-based IDS alerts. A common misconception is that finishing quickly reduces detection exposure, but IDS products monitor packet patterns and rates specifically to catch high-speed scans.
- D. Incorrect.
Incorrect. The -A option enables aggressive features such as OS detection, version detection, script scanning, and traceroute. These generate more traffic and more distinctive signatures, increasing the chance of detection. This option is useful for enumeration depth, not stealth.