A penetration tester is attempting to scan an internal corporate network from the internet without alerting the border sensor. Which is the most efficient technique should the tester consider using?

Spoofing an IP address changes the apparent source of packets but does not hide the nature or volume of scan traffic, and responses would not be routable back to the tester, making it ineffective for a usable scan.

Tunneling a scan over SSH encapsulates the Nmap or other scan traffic within an encrypted SSH connection, which border IDS and IPS sensors typically classify as normal encrypted traffic rather than a port scan. This technique leverages an existing or established SSH session to pivot into the internal network, making it the most efficient and covert method for scanning without triggering signature-based alerts on the border sensor.

Using high port numbers may bypass some basic firewall rules but does not encrypt or disguise the traffic pattern, so a modern border sensor can still detect and alert on the scan behavior.

Scanning with fragmented IP packets can evade older or simpler IDS signatures, but modern border sensors reassemble fragments before inspection, making fragmentation an unreliable and inefficient evasion technique.