Which Nmap Switch Helps Evade IDS or Firewalls?
Short answer
A Use Nmap's -D decoy option to mix the real scan with spoofed source addresses and confuse IDS/firewall logs.
Question
Key Takeaways
The exam tests whether you can identify Nmap's dedicated decoy-scanning switch for IDS/firewall evasion; the trap is choosing -T because slow timing templates can also reduce scan noise.
Nmap's -D decoy switch mixes real scan traffic with spoofed decoy source addresses, making IDS and firewall logs much harder to attribute. This page confirms -D as the intended answer and separates it from timing and output-related Nmap options.
Common mistake: Many learners choose -T because paranoid and sneaky timing templates make scans quieter, but -T is a timing control, not the dedicated decoy switch asked for in this question.
Expert Analysis
Why the Answer Is Correct
Nmap's -D option performs decoy scanning, injecting spoofed source addresses alongside the real scanner's traffic. When an IDS or firewall correlates events, it sees multiple apparent sources and cannot easily isolate the true initiator. In CEH-style Nmap questions, -D is treated as the direct firewall/IDS evasion switch because it targets source attribution rather than merely slowing the scan. Option A is the only choice that maps to this decoy mechanism.
Why the Other Options Are Wrong
Option B lists -n and -R, which control DNS resolution behavior and do not conceal the scanner from IDS or firewall logs. Option C is -T, the timing-template switch; while -T0 or -T1 can make scanning slower and less noisy, -T by itself is not the decoy-scanning mechanism the question asks for. Option D lists -oN, -oX, and -oG, which only select normal, XML, or grepable output formats. None of these switches directly obscure the scanner's identity in the way -D does.
Community Comment Notes
Several learners, including d10f290, focused on the decoy meaning of -D and described it as "solely meant for IDS evasion," which aligns with the exam's intended switch. yicx1 and hughnguyen argued for -T, correctly noting that paranoid and sneaky timing templates can reduce scan noise. That disagreement is useful: -T can lower detection risk, but the question asks for the Nmap switch associated with IDS/firewall evasion, and the decoy option -D is the direct match. g_man_rap and insaniunt also reinforced that -D is decoy scanning.
Official Reference
https://nmap.org/book/man-bypass-firewalls-ids.html
This link opens the official vendor documentation in a new tab.
Exam Strategy
Memorize Nmap short switches by category: -D for decoys, -T for timing templates, -oN/-oX/-oG for output formats, and -n/-R for DNS behavior. When a question specifically mentions IDS or firewall evasion with one switch, -D is the direct decoy technique; -T is only a secondary noise-reduction control.
Frequently Asked Questions
Why is Nmap -T not the best answer for IDS evasion here?
What does Nmap -D decoy scanning actually do?
Community Votes
71% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 5 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 5
-
d10f290 👍 4 Answered A-D (decoy Scan) is solely meant for IDS evasion,
-
g_man_rap 👍 1A. -D This switch is used for "decoy scanning" in Nmap. It allows the user to include fake IP addresses in the scanning traffic, making it appear as if many different hosts are scanning the target network. This can confuse and dilute the logs that an IDS or firewall generates, making it harder to identify the real source of the scan and is a direct method for evasion.
-
yicx1 👍 1 Answered CSo Nmap offers a simpler approach, with six timing templates. You can specify them with the -T option and their number (0–5) or their name. The template names are paranoid (0), sneaky (1), polite (2), normal (3), aggressive (4), and insane (5). The first two are for IDS evasion.
-
hughnguyen 👍 1 Answered C-D tells the network that there a multiple possible attackers, even though only one of them is real -T makes the attacker so quiet that the target doesn't even know it's being attacked Answer is C
-
insaniunt 👍 1 Answered A"-D" option in Nmap is used for decoy scanning
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.