Shape the probe packets#

The Evasion panel changes the shape of the packets the scanner sends. It presents traffic that does not match the obvious signature of a scan. This tests whether a firewall or intrusion detection system catches what it is meant to catch.

Most of these options work only when the scanner builds the packets itself. With the default TCP Connect technique, or with UDP scanning, the operating system builds the packets and the scanner cannot alter them. In that state the panel disables every field except TTL and Src Port, and shows the placeholder needs raw scan (e.g. SYN). To use the other fields, select a raw technique such as SYN on the configuration bar.

Splitting and corrupting packets#

Fragment Packets breaks each probe into small IP fragments. A device that inspects packets individually may not reassemble them, and so may not recognise the probe. MTU sets the fragment size. The value must be a multiple of 8. The field becomes editable only when you tick Fragment Packets.

Bad Checksum sends packets with deliberately invalid checksums. A correctly behaving host discards them, so a reply to a bad-checksum probe usually means an inspection device answered instead of the host. Bad Checksum therefore finds middleboxes. It does not hide from them.

Change the packet origin#

Four controls change where a probe appears to come from:

• Src Port: sends probes from a fixed source port. It works with every technique.
• Source IP: forges the source address. Replies go to the address you set rather than to you, so you do not see them unless you can observe that address.
• Spoof MAC: changes the hardware address. It has an effect only on the local network segment.
• Decoys: sends probes from a list of extra addresses beside your own, so the real scan mixes with traffic that appears to come from elsewhere. Enter a comma-separated list, and use RND for a randomly generated address.

Many firewall rules trust traffic from ports such as 53 or 20. Use Src Port to test whether such a rule exists. Source IP tests egress filtering. It is not a way to scan anonymously.

Set TTL and Data Len#

TTL sets how many hops a packet crosses before it expires, and it works with every technique. Set it one hop short of the distance to the target to probe what sits in front of the target rather than the target itself.

Data Len pads each probe with random data to a set length. Detection signatures often match the empty probes a scanner sends by default.

Before you send evasive probes#

These options test defences you are responsible for. Spoofed addresses and decoys in particular put traffic on the network that appears to come from third parties who have not agreed to it. The results are also harder to read than a plain scan, because you cannot be sure which replies were yours.

Start with a plain scan. Use this panel when you have a specific question about a specific control, and change one setting at a time. The Config Applied banner above the results reports which settings the engine applied, which it rejected, and why. The banner is the fastest way to tell a working evasion from an ignored one.