Firewalls and IDS/IPS systems exist specifically to catch and block scanning activity, so it makes sense that Nmap includes an entire category of techniques designed to slip past them. I want to be upfront about something before diving in: these techniques are the ones most likely to get you into legal or professional trouble if used outside an authorized scope. Everything here assumes you have explicit, written permission to test the target — a signed penetration testing agreement, a documented scope of work, or your own lab equipment.
With that established, let’s get into how these techniques actually work.
Why Evasion Techniques Exist
Firewalls and intrusion detection systems typically work by matching traffic against known patterns — a flood of SYN packets to sequential ports from one source is an obvious scan signature. Evasion techniques disrupt that pattern matching in various ways: by breaking packets into pieces, by hiding the real source among decoys, or by making scan traffic resemble something the firewall already trusts.
flowchart TD
A[Standard Nmap Scan] --> B[Firewall/IDS Pattern Match]
B --> C[Detected & Blocked/Logged]
D[Evasion Technique Applied] --> E[Firewall/IDS Pattern Match]
E --> F[Missed or Misattributed]
Packet Fragmentation
sudo nmap -f 192.168.1.10
sudo nmap -ff 192.168.1.10 # fragment even further
sudo nmap --mtu 24 192.168.1.10 # custom fragment size (multiple of 8)
How it works: Instead of sending a complete TCP header in one IP packet, Nmap splits it across multiple smaller IP fragments. Some older or poorly configured firewalls and IDS systems inspect packets individually without reassembling fragments first, meaning they never see a complete TCP header to match against their rules.
sequenceDiagram
participant Nmap
participant Firewall
participant Target
Nmap->>Firewall: Fragment 1 (partial header)
Nmap->>Firewall: Fragment 2 (remaining header)
Firewall->>Firewall: Inspects fragments individually - no match
Firewall->>Target: Forwards fragments
Target->>Target: Reassembles into full packet
Reality check: Modern firewalls and IDS platforms almost universally reassemble fragments before inspection specifically because this technique is well known. I treat -f as something worth understanding conceptually and testing in a lab, but I don’t expect it to bypass any reasonably current security appliance.
Decoy Scanning
nmap -D RND:10 192.168.1.10
nmap -D 10.0.0.1,10.0.0.2,ME,10.0.0.3 192.168.1.10
How it works: Nmap sends scan packets with spoofed source IP addresses interspersed with your real one, making it appear as though many different hosts are scanning the target simultaneously. ME in a decoy list specifies where your real IP falls in the sequence; RND:10 generates 10 random decoy addresses automatically.
flowchart LR
A[Real scanner IP] --> D[Target]
B[Decoy IP 1] --> D
C[Decoy IP 2] --> D
E[Decoy IP 3] --> D
D --> F[Firewall logs show 4 sources scanning simultaneously]
Important caveats:
- Decoys must be actual live, reachable hosts for the technique to be convincing — otherwise a competent analyst can filter them out by checking which “sources” never complete a TCP handshake.
- This does not hide your actual IP from the target — it only adds noise. Your real address is still in there among the decoys.
- Using real third-party IP addresses as decoys without their knowledge means their systems will show up in the target’s logs as apparent attackers — this can cause real problems for innocent third parties and is something I never do outside a fully isolated lab range.
Source Port Manipulation
nmap -g 53 192.168.1.10
nmap --source-port 53 192.168.1.10
How it works: Many older firewall rulesets trust traffic originating from specific “known good” ports — port 53 (DNS) and port 20 (FTP data) are classic examples, since administrators historically wrote overly permissive rules assuming that if traffic looks like it’s coming from a DNS server, it must be legitimate. Setting your source port to 53 with -g 53 can cause such firewalls to wave the scan through.
sequenceDiagram
participant Nmap
participant Firewall
Nmap->>Firewall: SYN from source port 53
Firewall->>Firewall: Rule: "allow anything from port 53 (assumed DNS)"
Firewall->>Firewall: Traffic passes without deeper inspection
Reality check: This is a legacy technique that worked well against older stateless packet filters. Modern stateful firewalls generally don’t extend this kind of trust based on source port alone, but I’ve still occasionally encountered older industrial or embedded network gear with exactly this kind of permissive rule.
MAC Address Spoofing
sudo nmap --spoof-mac 0 192.168.1.10 # random MAC
sudo nmap --spoof-mac Apple 192.168.1.10 # random Apple vendor MAC
sudo nmap --spoof-mac AA:BB:CC:DD:EE:FF 192.168.1.10 # specific MAC
Only relevant on local network segments (since MAC addresses don’t survive routing), this changes the apparent hardware vendor and identity of your scanning machine at Layer 2 — useful in lab exercises about network access control (NAC) systems that whitelist by MAC vendor prefix.
Appending Random Data
nmap --data-length 25 192.168.1.10
How it works: Appends random bytes to packets, changing their size signature. Some very basic pattern-matching detection systems flag scans partly based on packet size uniformity — Nmap’s default packets have a very consistent, recognizable size. Randomizing length disrupts that specific heuristic.
Idle (Zombie) Scan
sudo nmap -sI zombie_host 192.168.1.10
This is one of the cleverest — and most situational — techniques Nmap offers. It uses a third-party “zombie” host with predictable IP ID sequence numbers to bounce scan results off of, meaning the target only ever sees traffic from the zombie, never from you.
sequenceDiagram
participant Attacker
participant Zombie
participant Target
Attacker->>Zombie: Probe IP ID (baseline)
Attacker->>Target: SYN packet, spoofed source = Zombie
Target->>Zombie: SYN-ACK or RST (Zombie's IP ID changes based on response)
Attacker->>Zombie: Probe IP ID again
Attacker->>Attacker: Compare IP ID delta to infer port state
Requirements: The zombie host needs to be idle (no other traffic incrementing its IP ID counter) and must use predictable, incremental IP ID generation — a property that’s become rare on modern operating systems specifically because this technique made it a known weakness. Finding a viable zombie host today is genuinely difficult against modern targets, but the technique remains a fantastic study of TCP/IP side-channel reasoning.
Randomizing Target Scan Order
nmap --randomize-hosts 192.168.1.0/24
Scans hosts in a random rather than sequential order, disrupting the “sequential sweep” pattern that many IDS signatures specifically watch for.
Timing as an Evasion Tool
Slower scans generate less obviously anomalous traffic volume:
nmap -T1 192.168.1.10
nmap --scan-delay 5s 192.168.1.10
I cover timing templates in full depth in a dedicated article, but in the context of evasion: -T0 and -T1 specifically exist to spread probes out over a long enough window that rate-based IDS triggers never fire.
Practical Example: Combining Techniques
A layered evasion approach I’d use in an authorized red-team lab exercise, purely for technique demonstration:
sudo nmap -sS -f -D RND:5 -g 53 --data-length 20 -T2 192.168.1.10
This combines fragmentation, five random decoys, source port 53, randomized data length, and polite timing — a deliberately noisy example for teaching purposes, though in real engagements I’d typically apply only one or two techniques that address a specific detection mechanism I’ve actually confirmed is in place.
Python Integration
Automating evasion-flagged scans (with clear scope logging, which I always keep for accountability):
import nmap
import datetime
scanner = nmap.PortScanner()
scan_args = '-sS -f --data-length 20 -T2'
target = '192.168.1.10'
print(f"[{datetime.datetime.now()}] Starting evasion-technique scan against {target} (authorized lab range)")
scanner.scan(target, arguments=scan_args)
for host in scanner.all_hosts():
print(f"Host: {host}, State: {scanner[host].state()}")
Troubleshooting
Decoy scan seems to have no effect on results — decoys don’t change what Nmap reports to you; they only affect what the target’s logs show. Verify effectiveness by checking target-side logs (in a lab you control) rather than your own scan output.
Fragmented scan is much slower and less reliable — expected. Fragmentation adds overhead and some networks silently drop fragmented traffic entirely, which can make results less trustworthy than an unfragmented scan.
Source port trick has no effect — this only works against firewalls with legacy trust rules for specific ports; most modern stateful firewalls ignore source port entirely for filtering decisions.
Idle scan fails immediately — your chosen zombie host likely uses randomized IP ID generation (true of most modern OSes), making it unsuitable. Nmap will usually tell you this directly.
Limitations
None of these techniques guarantee evasion against a modern, well-configured security stack. Fragmentation and source-port tricks are largely legacy techniques that a properly maintained firewall from the last decade will handle correctly. Decoy scanning adds noise but doesn’t hide your real source. Treat this entire category as historically important and situationally useful against specific older or misconfigured infrastructure — not as a reliable bypass for modern defenses.
Security Best Practices
- Use evasion techniques only within a documented, authorized scope — using real third-party IPs as decoys without consent can cause real harm to uninvolved parties.
- Test evasion techniques in an isolated lab first so you understand exactly what each one changes about your traffic before using it in a live authorized engagement.
- Document which evasion techniques you used in any professional report — a defender reviewing detection gaps needs this information to actually improve their controls.
- Never treat evasion success as license to skip authorization — evading detection doesn’t change the legal status of unauthorized access.
Frequently Asked Questions
Do these techniques still work against modern firewalls? Rarely for fragmentation and source-port manipulation specifically, since those are well-known legacy weaknesses that most current security appliances handle correctly. Decoy scanning and timing-based evasion remain more broadly relevant.
Is using decoy IPs illegal? The legality depends entirely on jurisdiction and authorization scope — but using real third-party addresses without consent, even as decoys, can implicate uninvolved systems in what looks like malicious activity, which is a serious ethical and potentially legal problem regardless of your own intent.
What’s the single most useful evasion technique today? In my experience, timing-based evasion (-T1/-T2 combined with --scan-delay) tends to be the most broadly effective against rate-based detection, since it addresses a detection mechanism that’s still commonly deployed, unlike fragmentation which mostly targets outdated inspection methods.
Can I combine multiple evasion techniques in one scan? Yes, and I demonstrated exactly that above — but combining too many at once can make scans slow and unreliable, so I recommend testing each technique’s individual effect before layering them.
Append IP Options for Additional Evasion Testing
sudo nmap --ip-options "R" 192.168.1.10
The --ip-options flag lets you set specific IP header options — record route, strict/loose source routing, and others — that some legacy network equipment handles inconsistently. In practice this is one of the more niche techniques I’ve experimented with, mostly against older enterprise routing gear in lab settings, since most modern network stacks strip or ignore unusual IP options outright rather than acting on them in an exploitable way.
Bad Checksum Probes
nmap --badsum 192.168.1.10
Sends packets with an intentionally invalid TCP checksum. A properly implemented TCP/IP stack should silently discard these, meaning any response at all indicates the packet was processed by something other than a genuine, RFC-compliant endpoint — often a firewall or proxy responding on the target’s behalf rather than the actual host. I’ve used --badsum specifically as a diagnostic technique to detect the presence of an intercepting middlebox rather than as a true evasion method.
Why I Document Every Evasion Technique Used
On any authorized engagement where evasion techniques come into play, I keep a running log of exactly which flags were used against which targets, and when. This isn’t just good practice for accountability — it directly helps the client’s security team afterward, since a proper post-engagement debrief should include a clear answer to “here’s exactly what we tried to sneak past your defenses, and here’s whether it worked.” A pentest report that says “evasion attempted” without specifics is far less useful to a defender than one that says “fragmentation and source-port-53 spoofing were attempted against the perimeter firewall between 14:02 and 14:15 UTC and were both correctly blocked.”
# Example logging wrapper around an evasion-technique scan
echo "$(date -u): Starting fragmented scan against 192.168.1.10 (auth ref: PENTEST-2026-014)" >> engagement_log.txt
sudo nmap -sS -f -g 53 192.168.1.10 -oA frag_scan_result | tee -a engagement_log.txt
That kind of paper trail has saved me from awkward conversations more than once, and it’s the difference between “we tested your detection controls” and “we can prove exactly what we tested and when.”
Wrapping Up
Understanding evasion techniques taught me more about how firewalls and IDS systems actually inspect traffic than any amount of reading firewall documentation did. But I want to close on the same note I opened with: this is the sharpest category of tools in Nmap’s toolkit, and sharp tools demand careful hands. Use these to understand your own defenses, to demonstrate gaps in an authorized assessment, or to study TCP/IP mechanics in a lab — never against anything you don’t have clear, documented permission to test.
