Morris, an attacker, wanted to check whether the target AP is in a locked state. He attempted using different utilities to identify WPS-enabled APs in the target wireless network. Ultimately, he…

The `wash` utility, part of the Aircrack-ng suite, is specifically used to scan for and identify access points that have Wi-Fi Protected Setup (WPS) enabled, allowing an attacker to determine if a target AP is vulnerable to WPS attacks.

`ntptrace` is a utility used to trace a chain of NTP servers back to the primary reference (stratum 0) server, unrelated to wireless network scanning.

`macof` is a tool from the dsniff suite used to flood a local network with MAC addresses, aiming to exhaust switch CAM tables, leading to a MAC flooding attack.

`net View` is a Windows command-line utility used to display a list of computers and network devices available on the network or available shares on a specified computer.