312-50V9 · Question #416
Which NMAP feature can a tester implement or adjust while scanning for open ports to avoid detection by the network's IDS?
The correct answer is A. Timing options to slow the speed that the port scan is conducted. Nmap's timing options allow a tester to reduce scan speed, making traffic patterns less anomalous and harder for an IDS to flag as a port scan.
Question
Which NMAP feature can a tester implement or adjust while scanning for open ports to avoid detection by the network's IDS?
Options
- ATiming options to slow the speed that the port scan is conducted
- BFingerprinting to identify which operating systems are running on the network
- CICMP ping sweep to determine which hosts on the network are not available
- DTraceroute to control the path of the packets sent during the scan
How the community answered
(14 responses)- A71% (10)
- B7% (1)
- C14% (2)
- D7% (1)
Why each option
Nmap's timing options allow a tester to reduce scan speed, making traffic patterns less anomalous and harder for an IDS to flag as a port scan.
Nmap's timing templates (T0-T5) and granular timing options such as --scan-delay and --max-rate control the rate at which probes are sent. By slowing the scan significantly (e.g., T0 or T1), the traffic blends in with normal background noise, reducing the likelihood that an IDS will correlate the probes into a recognizable scan signature.
OS fingerprinting (-O) identifies the operating system of remote hosts and does nothing to reduce the visibility or detectability of the scan itself.
An ICMP ping sweep (-sn) is used to discover live hosts, not to evade IDS detection - in fact, a sweep of many hosts can itself trigger IDS alerts.
Traceroute (--traceroute) maps the network path packets travel and does not influence how detectable the port scan is to an IDS.
Concept tested: Nmap timing options for IDS evasion
Source: https://nmap.org/book/man-performance.html
Topics
Community Discussion
No community discussion yet for this question.