nerdexam
EC-Council

312-50V11 · Question #39

You are a Penetration Tester and are assigned to scan a server. You need to use a scanning technique wherein the TCP Header is split into many packets so that it becomes difficult to detect what the…

The correct answer is C. IP Fragment Scanning. IP Fragment Scanning splits the TCP header across multiple small IP fragments, making it difficult for packet filters and intrusion detection systems to determine the purpose of the scan.

Scanning Networks

Question

You are a Penetration Tester and are assigned to scan a server. You need to use a scanning technique wherein the TCP Header is split into many packets so that it becomes difficult to detect what the packets are meant for. Which of the below scanning technique will you use?

Options

  • AACK flag scanning
  • BTCP Scanning
  • CIP Fragment Scanning
  • DInverse TCP flag scanning

How the community answered

(65 responses)
  • A
    6% (4)
  • B
    3% (2)
  • C
    89% (58)
  • D
    2% (1)

Why each option

IP Fragment Scanning splits the TCP header across multiple small IP fragments, making it difficult for packet filters and intrusion detection systems to determine the purpose of the scan.

AACK flag scanning

ACK flag scanning sends packets with only the ACK flag set to probe firewall rule sets and distinguish stateful from stateless filters, not to fragment packets for evasion.

BTCP Scanning

TCP Scanning is a broad category covering many connection-based scan types and does not describe a specific packet-fragmentation evasion technique.

CIP Fragment ScanningCorrect

IP Fragment Scanning works by dividing the TCP header into multiple fragmented packets so that many firewalls and IDS engines, which do not reassemble fragments before inspection, cannot analyze the complete packet and identify the scan. This fragmentation effectively obscures the nature of the probe from security controls sitting on the network path. It is a recognized evasion technique used specifically when a penetration tester needs to avoid triggering signature-based detection.

DInverse TCP flag scanning

Inverse TCP flag scanning uses abnormal flag combinations such as FIN, URG, or PSH to elicit RST responses from closed ports on some operating systems, which is unrelated to IP fragmentation.

Concept tested: IP packet fragmentation for IDS and firewall evasion

Source: https://nmap.org/book/man-bypass-firewalls-ids.html

Topics

#IP fragment scanning#packet fragmentation#firewall evasion#stealth scanning

Community Discussion

No community discussion yet for this question.

Full 312-50V11 Practice