A penetration tester performing an internal network assessment needs to identify live hosts on the 10.0.0.0/8 network while minimizing IDS detection. Which scanning approach is MOST appropriate?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — use slow low-rate ICMP ping sweeps and ARP scans spread over time with randomized target ordering to reduce detection signatures. It avoids the high-rate sequential patterns that IDS rules and anomaly detection systems recognize as port scans. ICMP and ARP are also less suspicious than TCP SYN scans in many environments.
Full Explanation
Slow low-rate ICMP ping sweeps and ARP scans spread over time with randomized target ordering are correct because low-rate randomized scanning avoids the high-rate sequential patterns that IDS rules and anomaly detection systems recognize as port scans. ICMP and ARP are also less suspicious than TCP SYN scans in many environments. Running a full TCP port scan with Nmap against the entire /8 range at maximum speed is wrong because maximum-speed full-range scanning produces easily detected high-rate anomalies. Performing a UDP scan of all 65535 ports on every host simultaneously is wrong because it is extremely noisy. Using a SYN flood against each subnet gateway is wrong because SYN flooding is a denial-of-service technique, not valid reconnaissance, and is clearly detectable.