312-50V12 · Question #319
Which Nmap switch helps evade IDS or firewalls?
The correct answer is A. -D. The Nmap -D switch implements decoy scans, a technique designed to obfuscate the true source of a scan to evade detection by IDS or firewalls.
Question
Options
- A-D
- B-n/-R
- C-T
- D-oN/-oX/-oG
How the community answered
(14 responses)- A86% (12)
- B7% (1)
- C7% (1)
Why each option
The Nmap `-D` switch implements decoy scans, a technique designed to obfuscate the true source of a scan to evade detection by IDS or firewalls.
The `-D` (decoy) switch in Nmap sends spoofed packets from multiple decoy IP addresses alongside the legitimate scanner's IP, making it difficult for IDS/firewalls to distinguish the actual source of the scan and aiding in evasion.
The `-n` (no DNS resolution) and `-R` (resolve DNS) switches control Nmap's DNS behavior, which affects scan speed and logging, but not active IDS/firewall evasion.
The `-T` (timing template) switch adjusts scan aggressiveness and speed; while slower templates (e.g., -T0) can reduce detectability, it is a timing control, not a direct evasion technique like decoys.
The `-oN`, `-oX`, and `-oG` switches specify different formats for Nmap's output files (normal, XML, grepable), which do not contribute to evading IDS or firewalls during the scan itself.
Concept tested: Nmap IDS/Firewall Evasion Techniques (Decoy Scans)
Source: https://nmap.org/book/man-bypass-firewalls-ids.html
Topics
Community Discussion
No community discussion yet for this question.