312-50V13 · Question #408
Which Nmap switch helps evade IDS or firewalls?
The correct answer is C. -T. The Nmap -T switch helps evade IDS or firewalls when set to slower timing templates like Paranoid or Sneaky.
Question
Options
- A-n/-R
- B-0N/-0X/-0G
- C-T
- D-D
How the community answered
(21 responses)- A5% (1)
- B5% (1)
- C76% (16)
- D14% (3)
Why each option
The Nmap `-T` switch helps evade IDS or firewalls when set to slower timing templates like Paranoid or Sneaky.
The `-n` (no DNS resolution) and `-R` (DNS resolution for everything) options control DNS lookups, not IDS/firewall evasion.
The `-0N`, `-0X`, and `-0G` options are used to specify various output formats (Normal, XML, Grepable) for scan results, not for evasion.
The Nmap `-T` (timing) option allows users to specify how aggressively Nmap should scan. Specifically, timing templates like `-T0` (Paranoid) and `-T1` (Sneaky) introduce significant delays between probes and use sequential scanning to avoid triggering intrusion detection systems (IDS) or firewalls, making the scan less noticeable.
The `-D` (decoy) switch is also used for IDS/firewall evasion by sending decoy packets, but `-T` specifically refers to timing templates designed for stealth.
Concept tested: Nmap IDS evasion techniques
Source: https://nmap.org/book/man-performance.html
Topics
Community Discussion
No community discussion yet for this question.