Stealth Scanning with IDLE/IPID Technique in Zenmap

312-50v13 By islever Editorial Last updated

Scanning Networks

Short answer

D Use the IDLE/IPID header scan technique with the command "-sI" to mask the source IP via a zombie host.

Question

During a red team assessment, a CEH is given a task to perform network scanning on the target network without revealing its IP address. They are also required to find an open port and the services available on the target machine. What scanning technique should they employ, and which command in Zenmap should they use?
  1. Use SCTP INIT Scan with the command "-sY"
  2. Use UDP Raw ICMP Port Unreachable Scanning with the command "-sU"
  3. Use the ACK flag probe scanning technique with the command "-sA"
  4. Use the IDLE/IPID header scan technique with the command "-sI" Correct Answer

Key Takeaways

The core concept is IP address obfuscation during scanning, where the common trap is choosing standard stealth scans like SYN that still reveal the source IP.

This question addresses how to perform network scanning while hiding the attacker's IP address using the IDLE scan technique (-sI) in Zenmap.

Common mistake: Learners often choose ACK flag probe (-sA) or SCTP INIT Scan (-sY), failing to realize these techniques do not hide the source IP address from the target's logs.

Expert Analysis

Why the Answer Is Correct

The IDLE scan (command -sI) is the only technique listed that allows the attacker to remain completely anonymous. It works by exploiting a 'zombie' host—an idle system with predictable IP identification (IPID) sequence numbers—to send packets to the target. The target sees the zombie's IP address, not the attacker's, effectively masking the true origin of the scan.

Why the Other Options Are Wrong

SCTP INIT Scan (-sY), UDP Raw ICMP Port Unreachable (-sU), and ACK flag probe (-sA) all involve sending packets directly from the attacker's machine to the target. Consequently, the target will log the attacker's actual IP address, violating the requirement to not reveal it. While SYN scan (-sS) is also stealthy regarding connection state, it still reveals the source IP.

Community Comment Notes

The community consensus strongly supports option D. As pindinga1 noted, the IDLE scan leverages a zombie host to relay the scan, making it appear as if the scan is originating from the zombie rather than the attacker. Another user emphasized that this technique provides complete anonymity because no packets are sent directly from the attacker's machine.

Exam Strategy

When a question emphasizes 'hiding your IP address' or 'anonymity' during scanning, immediately consider the IDLE scan (-sI). Remember that most other Nmap flags (SYN, ACK, UDP, TCP Connect) send packets from your own interface.

Frequently Asked Questions

Why doesn't SYN scan hide my IP?

SYN scan hides the connection state but sends packets from your IP. The target logs your source address, so you are not anonymous.

What is a zombie host in IDLE scan?

An idle host with predictable IPID increments. The attacker manipulates its IPID to infer open/closed ports on the real target without direct contact.

More 312-50v13 FAQ →

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. pindinga1 👍 3 Answered D
    D. Use the IDLE/IPID header scan technique with the command "-sI" Explanation: The IDLE scan (-sI) is a stealthy scanning technique that allows a hacker to scan a target without revealing their own IP address. Instead, it leverages a "zombie" (an idle host with predictable IPID sequence numbers) to send packets on behalf of the attacker. Why is this the best choice? The attacker's IP address remains hidden because the "zombie" host is the one interacting with the target. It provides open port detection while avoiding direct interaction with the target. It is difficult to trace back to the attacker, making it useful for stealthy reconnaissance in a red team assessment.
  2. 91a0021 👍 2 Answered D
    IDLE Scan (-sI) is a stealthy scanning technique that allows an attacker to scan a target network without revealing their own IP address. It uses a "zombie" host (an idle system) to relay the scan, making it appear as if the scan is originating from the zombie rather than the attacker. It does not send packets directly from the attacker's machine, thus providing complete anonymity. It can detect open ports and services without being easily detected by intrusion detection systems (IDS).
  3. Dogeo 👍 2 Answered D
    The IDLE/IPID header scan technique (-sI) is the best option for performing a network scan while keeping the attacker's IP address hidden. It is specifically designed for stealth and is the most appropriate choice for this red team task.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Agent-Based vs Network-Based Vulnerability Scanners

S-grade

Network Sniffing Techniques for Penetration Testing

S-grade

File-less Malware Bypassing Application Whitelisting

S-grade

SQL Injection Bypass in Login Forms

S-grade

← Back to 312-50v13 Study Guide