Which of the following scanning method splits the TCP header into several packets and makes it difficult for packet filters to detect the purpose of the packet?

ICMP Echo scanning uses ping requests to discover live hosts and does not involve splitting TCP headers across IP fragments.

IP fragmentation allows an attacker to divide a TCP packet so that the header (including flags like SYN or FIN) is split across two or more IP fragments. Many stateless packet filters and older firewalls inspect individual fragments rather than reassembling them, so they cannot determine the true purpose of the traffic. This technique is specifically designed to bypass filtering devices by exploiting their inability to process fragmented TCP headers.

ACK flag probe scanning sends ACK packets to determine firewall rulesets and stateful vs. stateless filtering - it does not use IP fragmentation to obscure headers.

IPID scanning (idle/zombie scanning) exploits the IP ID field of a zombie host to infer open ports and does not rely on fragmenting TCP headers.