312-50V11 · Question #968
Which Nmap switch helps evade IDS or firewalls?
The correct answer is D. -D. The -D switch in Nmap creates decoy scans to obscure the real scanner's identity, helping evade IDS and firewall detection.
Question
Options
- A-n/-R
- B-0N/-0X/-0G
- C-T
- D-D
How the community answered
(31 responses)- A6% (2)
- B3% (1)
- C3% (1)
- D87% (27)
Why each option
The -D switch in Nmap creates decoy scans to obscure the real scanner's identity, helping evade IDS and firewall detection.
-n/-R control DNS resolution behavior (no DNS lookup or always reverse DNS) and have no IDS or firewall evasion function.
-oN/-oX/-oG are output format switches that save scan results in normal, XML, or grepable format, not evasion techniques.
-T sets timing templates (0-5) to control scan speed, which can reduce detectability through slowness but does not actively evade IDS via packet-source manipulation.
The -D (decoy) switch causes Nmap to send scan packets that appear to originate from multiple decoy IP addresses alongside the real source IP. This makes it difficult for IDS or firewalls to identify the true attacker's IP, as the target logs will show numerous source addresses, effectively masking the real scanner's identity.
Concept tested: Nmap decoy scanning for IDS evasion
Source: https://nmap.org/book/man-bypass-firewalls-ids.html
Topics
Community Discussion
No community discussion yet for this question.