A vulnerability assessor is looking to establish a baseline of all IPv4 network traffic on the local VLAN without a local IP address. Which of the following Nmap command sequences would best provide…

Question

Options

• Asudo nmap --script=bro* -e ethO
• Bsudo nmap -sF --script=* -e ethO
• Csudo nmap -sV -sT -p 0-65535 -e ethO
• Dsudo nmap -sV -p 0-65535 0.0.0.0/0

• A
  79% (33)
• B
  12% (5)
• C
  2% (1)
• D
  7% (3)

Explanation

The key constraint is 'without a local IP address,' which means the tester needs passive traffic capture rather than active scanning. Option A uses sudo nmap --script=bro* -e eth0, where the bro* NSE scripts invoke Bro/Zeek-style passive network analysis, and -e eth0 specifies the interface. This allows Nmap to operate in a passive, promiscuous mode on the specified interface without needing an assigned IP address, making it suitable for baselining traffic. Option B uses -sF (FIN scan), which is an active technique requiring an IP. Option C uses active scanning flags (-sV, -sT) that require a source IP. Option D attempts to scan all possible IPs (0.0.0.0/0), which is impractical and still requires an active source address.

No community discussion yet for this question.