A penetration tester is attempting to scan an internal corporate network from the internet without alerting the border sensor. Which is the most efficient technique should the tester consider using?

IP spoofing changes the source address but does not hide or encrypt the scan traffic itself, so border sensors can still detect and alert on abnormal port-scanning patterns.

Tunneling a scan over SSH encapsulates all scan traffic within an encrypted SSH connection, making the traffic appear as legitimate SSH communication on port 22. Border sensors and IDS devices typically cannot inspect the encrypted payload, so the underlying scan activity remains hidden. This is the most efficient method because it bypasses detection while maintaining full scan capability.

Using high port numbers does not inherently encrypt or disguise scan traffic, and modern border sensors monitor all port ranges for scanning behavior.

Fragmented IP packets can evade some older packet-inspection tools, but modern IDS/IPS devices reassemble fragments before analysis, making this technique less reliable and less efficient than SSH tunneling.