312-50V11 · Question #627
Study the log below and identify the scan type.
The correct answer is D. nmap -sO -T 192.168.1.10. The nmap -sO flag performs an IP protocol scan, which probes which IP-layer protocols (ICMP, TCP, UDP, IGMP, etc.) are supported rather than scanning TCP or UDP ports.
Question
Study the log below and identify the scan type.
Exhibit
Options
- Anmap -sR 192.168.1.10
- Bnmap -sS 192.168.1.10
- Cnmap -sV 192.168.1.10
- Dnmap -sO -T 192.168.1.10
How the community answered
(43 responses)- A5% (2)
- B23% (10)
- C12% (5)
- D60% (26)
Why each option
The nmap -sO flag performs an IP protocol scan, which probes which IP-layer protocols (ICMP, TCP, UDP, IGMP, etc.) are supported rather than scanning TCP or UDP ports.
The -sR flag performs an RPC scan to identify RPC-based services on open ports, which would show RPC program data rather than IP protocol numbers.
The -sS flag performs a TCP SYN (half-open) scan, which would log TCP port states (open, closed, filtered) rather than IP protocol responses.
The -sV flag performs service and version detection against open ports, which would log service names and version strings rather than raw protocol numbers.
The -sO switch instructs nmap to iterate through IP protocol numbers (0-255) and send raw IP packets to determine which protocols the target host responds to, producing output listing protocol numbers rather than port numbers. The -T flag sets the timing template, controlling scan aggressiveness and packet rate. This scan type produces a log showing protocol IDs rather than port states, which is the distinguishing characteristic of the observed log.
Concept tested: Nmap IP protocol scan (-sO) log identification
Source: https://nmap.org/book/scan-methods-ip-protocol-scan.html
Topics
Community Discussion
No community discussion yet for this question.
