Which of the following scanning method splits the TCP header into several packets and makes it difficult for packet filters to detect the purpose of the packet?

Question

Options

• AACK flag probe scanning
• BICMP Echo scanning
• CSYN/FIN scanning using IP fragments
• DIPID scanning

• A
  2% (1)
• B
  2% (1)
• C
  91% (41)
• D
  4% (2)

Explanation

SYN/FIN Scanning Using IP Fragments

Option C is correct because IP fragmentation deliberately splits the TCP header across multiple small packets, preventing packet filters and firewalls from reassembling and inspecting the full header to determine the packet's intent - effectively hiding the SYN and FIN flags used to probe a target system.

Why the distractors are wrong:

• Option A (ACK flag probe scanning) sends intact ACK packets to map firewall rules and determine stateful vs. stateless filtering - it does not fragment packets.
• Option B (ICMP Echo scanning) uses standard ping requests to discover live hosts and has nothing to do with TCP header manipulation or fragmentation.
• Option D (IPID scanning) exploits the IP ID sequence number in packet headers to infer port states indirectly through a "zombie" host - again, no fragmentation of TCP headers is involved.

Memory Tip: Think of IP fragments like shredding a document before passing it through a security checkpoint - the guard (packet filter) can't read the full message because the pieces arrive separately. The keyword "splits" in the question is your direct clue pointing to fragmentation.

No community discussion yet for this question.