312-50V9 · Question #520
Study the log below and identify the scan type.
The correct answer is D. nmap -sO -T 192.168.1.10. The -sO flag triggers Snort's IP protocol scan, which probes each IP protocol number to determine which protocols (TCP, UDP, ICMP, IGMP, etc.) the target supports, producing a log pattern of varied protocol responses.
Question
Study the log below and identify the scan type.
Exhibit
Options
- Anmap -sR 192.168.1.10
- Bnmap -sS 192.168.1.10
- Cnmap -sV 192.168.1.10
- Dnmap -sO -T 192.168.1.10
How the community answered
(38 responses)- A3% (1)
- B13% (5)
- C8% (3)
- D76% (29)
Why each option
The -sO flag triggers Snort's IP protocol scan, which probes each IP protocol number to determine which protocols (TCP, UDP, ICMP, IGMP, etc.) the target supports, producing a log pattern of varied protocol responses.
nmap -sR performs an RPC scan to enumerate RPC services on open ports, which would generate port-specific RPC probes rather than multi-protocol entries.
nmap -sS performs a TCP SYN stealth scan, which only interacts with TCP ports and would not produce log entries across varied IP protocol numbers.
nmap -sV performs version detection against open TCP/UDP ports to identify running service versions, not a protocol-level sweep across all IP protocol numbers.
nmap -sO performs an IP protocol scan by iterating through all 256 IP protocol numbers and sending raw packets with each protocol field set; the target's ICMP 'protocol unreachable' or lack-of-response reveals which protocols are active. The -T flag sets the timing template for speed control. The resulting log shows entries across multiple protocol numbers rather than port-based responses, which distinguishes this scan type from TCP or UDP scans.
Concept tested: nmap IP protocol scan (-sO) identification
Source: https://nmap.org/book/scan-methods-ip-protocol-scan.html
Topics
Community Discussion
No community discussion yet for this question.