Which Zenmap Scan Hides the Scanner's IP While Finding Open Ports?
During a red team assessment, a CEH is given a task to perform network scanning on the target network without revealing its IP address. They are also required to find an open port and the services available on the target machine. What scanning technique should they employ, and which command in Zenmap should they use?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests whether you can match an anonymous port-scanning requirement to Nmap's IDLE scan and recognize that -sA, -sU, and -sY still originate from the tester's IP.
The IDLE/IPID header scan (-sI) lets a CEH use a zombie host to scan a target's TCP ports without exposing the scanner's own IP address. This page explains why D is the answer, how Zenmap's -sI option works, and why ACK, UDP, and SCTP scans fail the anonymity requirement.
The common wrong answer is C (-sA ACK scan), because it sounds stealthy and can evade some stateful firewalls, but ACK scanning only classifies filtered versus unfiltered ports and still sends packets from the scanner's IP.
Community Discussion (7 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
IDLE/IPID header scanning (-sI) is the only listed technique designed for blind, source-IP-hiding port discovery. In Zenmap/Nmap the tester specifies a zombie host whose IPID sequence is predictable; probes to the target are spoofed as the zombie, and changes in the zombie's IPID value reveal whether the target port is open. Because the target never receives a packet sourced from the tester's real address, the scan satisfies the "without revealing its IP address" constraint while still identifying open TCP ports and associated services. The -sI command therefore matches both requirements in the scenario.Why the Other Options Are Wrong
A's-sY SCTP INIT scan is an SCTP-oriented scan variant, but it sends probes from the tester's own IP and does not provide zombie-based anonymity. B's -sU UDP scan also originates from the scanner's address, is slow, and ICMP port-unreachable responses can reveal the source. C's -sA ACK scan is a firewall-mapping technique that distinguishes filtered from unfiltered ports; it cannot reliably identify open TCP ports, and its packets still carry the tester's source IP. None of these combines source-IP hiding with open-port discovery as -sI does.Community Comment Notes
As insaniunt and qtygbapjpesdayazko noted, the IDLE scan impersonates another computer through spoofing and uses a "zombie" host to scan the remote target. brrbrr summarized it as "blind port scanning (without sending any packet with own IP)," while vibhorsharma1998.vs tied the answer to spoofing. The unanimous D votes reflect that reasoning, but the technical differentiator remains that only-sI both hides the source and enumerates open ports. Official Reference
Exam Strategy
When the stem says "without revealing its IP address," look for a scan that uses a zombie or spoofed source, not merely a stealthy TCP flag combination. In Zenmap, bind that concept to -sI; -sA, -sU, and -sY are source-IP-bearing scans.
Frequently Asked Questions
Why does the IDLE/IPID scan (-sI) hide the scanner's IP?
It spoofs packets from a zombie host and infers open ports by watching the zombie's IPID changes, so the target never sees the tester's real address.
Can ACK scan (-sA) find open ports while staying anonymous?
No. -sA maps firewall behavior rather than open TCP ports and still sends probes from the scanner's IP address.