Which option makes requested scans use tiny fragmented IP packets, helping evasion?

Which option makes requested scans use tiny fragmented IP packets, helping evasion?

• A. -S
• B. -e
• C. -f
• D. -v

Answer: (C)

Fragmentation is a technique where each probe is broken into multiple small IP fragments, making it harder for some defenses to inspect the full payload and identify the scan. The flag that makes requested scans use tiny IP fragments is the one that directs Nmap to fragment packets instead of sending them in a single unit. By sending fragmented packets, the scan can slip past some simple detection rules that don’t reassemble fragments before filtering, aiding evasion in certain networks. However, fragmentation can also impair accuracy, as legitimate reassembly at the target is required for proper interpretation, and many modern defenses do properly reassemble and inspect fragments. The other switches don’t affect fragmentation: one is for spoofing the source address, another selects the network interface, and another merely increases verbosity.

Fragmentation is a technique where each probe is broken into multiple small IP fragments, making it harder for some defenses to inspect the full payload and identify the scan. The flag that makes requested scans use tiny IP fragments is the one that directs Nmap to fragment packets instead of sending them in a single unit. By sending fragmented packets, the scan can slip past some simple detection rules that don’t reassemble fragments before filtering, aiding evasion in certain networks. However, fragmentation can also impair accuracy, as legitimate reassembly at the target is required for proper interpretation, and many modern defenses do properly reassemble and inspect fragments.

The other switches don’t affect fragmentation: one is for spoofing the source address, another selects the network interface, and another merely increases verbosity.