Stealth Scanning with IDLE/IPID Technique in Zenmap
During a red team assessment, a CEH is given a task to perform network scanning on the target network without revealing its IP address. They are also required to find an open port and the services available on the target machine. What scanning technique should they employ, and which command in Zenmap should they use?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The core concept is IP address obfuscation during scanning, where the common trap is choosing standard stealth scans like SYN that still reveal the source IP.
This question addresses how to perform network scanning while hiding the attacker's IP address using the IDLE scan technique (-sI) in Zenmap.
Learners often choose ACK flag probe (-sA) or SCTP INIT Scan (-sY), failing to realize these techniques do not hide the source IP address from the target's logs.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The IDLE scan (command-sI) is the only technique listed that allows the attacker to remain completely anonymous. It works by exploiting a 'zombie' host—an idle system with predictable IP identification (IPID) sequence numbers—to send packets to the target. The target sees the zombie's IP address, not the attacker's, effectively masking the true origin of the scan.Why the Other Options Are Wrong
SCTP INIT Scan (-sY), UDP Raw ICMP Port Unreachable (-sU), and ACK flag probe (-sA) all involve sending packets directly from the attacker's machine to the target. Consequently, the target will log the attacker's actual IP address, violating the requirement to not reveal it. While SYN scan (-sS) is also stealthy regarding connection state, it still reveals the source IP.Community Comment Notes
The community consensus strongly supports option D. As pindinga1 noted, the IDLE scan leverages a zombie host to relay the scan, making it appear as if the scan is originating from the zombie rather than the attacker. Another user emphasized that this technique provides complete anonymity because no packets are sent directly from the attacker's machine.Exam Strategy
When a question emphasizes 'hiding your IP address' or 'anonymity' during scanning, immediately consider the IDLE scan (-sI). Remember that most other Nmap flags (SYN, ACK, UDP, TCP Connect) send packets from your own interface.
Frequently Asked Questions
Why doesn't SYN scan hide my IP?
SYN scan hides the connection state but sends packets from your IP. The target logs your source address, so you are not anonymous.
What is a zombie host in IDLE scan?
An idle host with predictable IPID increments. The attacker manipulates its IPID to infer open/closed ports on the real target without direct contact.