312-50 Question 273
Single answer▪ IDS/Firewall Evading ToolsDuring an authorized external penetration test, you discover that a perimeter firewall allows outbound and return traffic for web browsing, but an inline IDS appears to trigger and block your Nmap scans when you use a standard SYN scan against a public-facing server. You want to continue host and service enumeration while reducing the chance of IDS detection by altering packet characteristics rather than tunneling through another protocol. Which Nmap technique is the most appropriate choice in this scenario?
- A
Use Nmap fragmentation with the -f option to split probe packets into smaller IP fragments
- B
Use Nmap version detection with -sV so the IDS cannot identify the scan pattern
- C
Use Nmap OS detection with -O because operating system fingerprinting generates less suspicious traffic than port scanning
- D
Use Nmap ping sweep with -sn because host discovery is equivalent to service enumeration
Show answer and explanation
Correct answer: A
Explanation
This question tests whether the candidate can distinguish between Nmap features used for enumeration and those used for IDS/firewall evasion. In CEH-level practice, common evasion concepts include packet fragmentation, decoys, source port manipulation, timing adjustments, and using proxies where appropriate. Here, the scenario explicitly asks for a method that changes packet characteristics rather than tunneling traffic through another protocol, making fragmentation the best fit. Nmap documents fragmentation via -f and MTU control via --mtu as packet manipulation options for evasion, though modern networks frequently defeat these methods through packet normalization and reassembly at the firewall/IDS layer. Therefore, fragmentation should be understood as a valid evasion technique, but not a guaranteed bypass. Best practice in authorized assessments is to use such options only within the rules of engagement and to validate findings carefully because evasion settings can also affect scan accuracy.
- A. Correct.
Correct. Nmap's packet fragmentation option (-f, or alternatively --mtu) is a classic IDS/firewall evasion technique intended to split packets into smaller fragments so some packet filters or poorly reassembling IDS devices may have more difficulty inspecting the full probe. In the scenario, the goal is specifically to alter packet characteristics to reduce IDS detection during enumeration, and fragmentation directly addresses that requirement. While modern IDS/IPS platforms often normalize or reassemble traffic and can still detect the scan, this is still the most appropriate tool/technique among the choices for IDS/firewall evasion.
- B. Incorrect.
Incorrect. The -sV option enables service/version detection after open ports are found; it does not inherently evade IDS. In fact, version detection usually increases interaction with the target and can generate more distinctive traffic, making detection more likely rather than less. A candidate might choose this because it helps with enumeration, but it does not satisfy the requirement to reduce detection by changing packet behavior.
- C. Incorrect.
Incorrect. The -O option performs OS detection by sending multiple probes and analyzing TCP/IP stack behavior. This is not an evasion technique and often produces additional traffic patterns that IDS tools can recognize. The misconception is assuming that fingerprinting is somehow quieter than scanning; in practice, it is a separate discovery feature, not a stealth control.
- D. Incorrect.
Incorrect. The -sn option performs host discovery only and disables port scanning. It may identify whether a host is up, but it does not provide service enumeration, which the tester still needs. Someone might choose it because it sends less traffic, but it fails to meet the stated objective of continuing host and service enumeration.