What firewall evasion scanning technique make use of a zombie system that has low network activity as well as its fragment identification numbers?

Question

Options

• ADecoy scanning
• BPacket fragmentation scanning
• CSpoof source address scanning
• DIdle scanning

• B
  5% (2)
• C
  2% (1)
• D
  93% (40)

Explanation

Idle Scanning Explained

Idle scanning (D) is correct because it uniquely exploits a "zombie" host - an idle system with minimal network traffic - by leveraging its IP fragment identification (IPID) numbers to indirectly probe a target. The attacker never directly communicates with the target; instead, they monitor incremental changes in the zombie's IPID sequence to infer whether ports are open or closed, effectively hiding the attacker's true IP address.

Why the distractors are wrong:

• Decoy scanning (A) masks the attacker by mixing real scan traffic with spoofed decoy IP addresses - no zombie or IPID numbers are involved.
• Packet fragmentation scanning (B) splits packets into tiny fragments to bypass firewall inspection rules, but does not use a zombie system.
• Spoof source address scanning (C) simply falsifies the source IP in packets, with no dependency on a zombie's network activity or IPID tracking.

Memory Tip: Think "IDLE = Zombie doing nothing" - the zombie is idle (low network activity), and you watch its ID numbers (IPID) change to stealthily gather information. If the system were busy, the IPID increments would be unreliable, ruining the technique.

No community discussion yet for this question.