Which Zenmap Option Performs an ICMP Timestamp Ping Scan?
A security analyst uses Zenmap to perform an ICMP timestamp ping scan to acquire information related to the current time from the target host machine. Which of the following Zenmap options must the analyst use to perform the ICMP timestamp ping scan?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests recognition of Nmap/Zenmap host-discovery flags, and the trap is confusing -PP (ICMP timestamp) with -PU (UDP ping) or -Pn (skip discovery).
Zenmap's ICMP timestamp ping scan maps to Nmap's -PP host-discovery option, which asks the target for its current time. This page confirms C is the correct answer and explains why -PU, -Pn, and -PY are different ping types.
Learners often pick -PU because it also contains a P and is a ping scan, but -PU sends UDP probes to a port, not ICMP timestamp requests; -Pn merely disables host discovery.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Nmap's -PP option performs an ICMP timestamp ping, sending an ICMP timestamp request (type 13) and interpreting the timestamp reply (type 14). Zenmap exposes the same underlying Nmap host-discovery option, so the correct selection is PP, matching option C. This directly satisfies the analyst's goal of learning the target host's current time. The unanimous learner votes for C do not by themselves prove correctness, but they align with Nmap's documented host-discovery behavior.Why the Other Options Are Wrong
-Pn (shown as Pn) skips host discovery and assumes every target is up, so it generates no ICMP timestamp query. -PU is the UDP ping option, which sends UDP packets to a port and watches for ICMP port-unreachable replies. -PY performs an SCTP INIT ping, not an ICMP timestamp request. None of these retrieves time information from the host, so they cannot satisfy the scenario.Community Comment Notes
ET0722 cites CEH module 3 and states that "ICMP timestamp ping scan uses -PP option". insaniunt describes -PP as sending an ICMP Echo Request with a timestamp request to gather current time, which matches the timestamp-request purpose. pboniface adds that "-PP is the Nmap option that specifies an ICMP timestamp request." No commenter argues for -PU, -Pn, or -PY, so the community discussion supports C rather than contradicting it.Official Reference
Exam Strategy
Memorize the Nmap host-discovery flag family by protocol: -PE echo, -PP timestamp, -PM netmask, -PU UDP, and -PY SCTP. On the exam, translate Zenmap menu names back to the raw Nmap switches; the question is testing the switch, not the GUI layout.
Frequently Asked Questions
Why is -PU not the Zenmap ICMP timestamp ping option?
-PU performs a UDP ping by sending probes to a target port, not an ICMP timestamp request. It cannot retrieve the host's current time.
What does -PP actually send during host discovery?
-PP sends an ICMP timestamp request (type 13) and reads the timestamp reply (type 14), revealing the target's clock value.