Evade Detection with Decoy Scans

Every serious penetration tester hits the same wall: your target's intrusion detection system (IDS) or firewall flags your SYN sweep the moment you start. A single source IP is easy to block, alert on, or trace back to you. The solution isn't hiding your scans completely — it's making them look like noise. Decoy scans and idle scans are two proven ways to evade detection by drowning your real traffic in decoys or using an unwitting third party as a proxy. In this lesson, you'll learn how both work, when to use each, and how to execute them safely and ethically.

The Problem This Lesson Solves

Blunt port scanning is the loudest thing you can do on a network. A standard nmap SYN scan from one IP creates a clear, repeatable pattern: hundreds of packets to a single host, all from the same source. Any half-decent IDS or firewall will flag it, and your client's security team will see you coming a mile away.

The real challenge in authorized penetration testing is detection evasion — not because you're hiding malicious activity, but because you need to assess how well the target's defenses actually work. If your scan is detected, the target may change its behavior, invalidating your results. Worse, you could be blocked entirely.

Decoy and idle scans solve this by breaking the link between the scan and its true source. Decoy scans mix your traffic with decoy IPs, making it hard to tell which address is real. Idle scans route your probe through a passive host (the "zombie"), so the target never sees your IP at all. Both are core techniques in the ethical hacker's reconnaissance toolkit.

Core Concept / Mental Model

Think of decoy scanning like a bank robber throwing multiple dummy cars at the police while the real getaway car slips away unnoticed. Each decoy car looks like a potential suspect, but only one is actually involved. Similarly, a decoy scan sends packets from your IP and from several fake IPs (decoys), so the target's logs show multiple hosts scanning it — none more suspicious than the others.

Idle scanning is more like using a staged car chase: you never drive to the bank yourself. Instead, you send a remote-controlled drone (the zombie host) to do the scouting. The target only ever sees the drone's IP, never yours. The trick is that the drone's IP ID counter changes in predictable ways when it receives unsolicited SYN-ACK packets, and you can measure that change to infer open ports.

Key Definitions

• Decoy scan: A scan where the real source IP is hidden among several decoy IPs. The target sees multiple sources, none of which is clearly the attacker.
• Idle scan: A scan that uses a third-party host (the zombie) to probe the target. The zombie's IP — not yours — appears in target logs, and the zombie's IP ID sequence reveals port states.
• IP ID (Identification field): A 16-bit field in IP headers used for fragmentation reassembly. Most operating systems increment it predictably, which idle scans exploit.

How It Works Step by Step

Decoy Scan Mechanics

1. Choose decoys: Pick 5–20 IP addresses that are alive on the target network (or even random public IPs). Decoys should not be your actual IP.
2. Send the scan: Using a tool like Nmap, send the same probe (e.g., SYN) to the target from your IP and from each decoy IP simultaneously.
3. Observe the target's view: The target sees multiple sources scanning it. Logs list all of them, and there's no obvious way to tell which is real.
4. Real traffic is mixed in: Your real packets are just one of many similar streams. Unless the IDS has deep packet inspection or knows your IP, you evade simple detection.

Idle Scan Mechanics

The idle scan uses the zombie's IP ID counter as a side channel:

1. Find a zombie: A host that is idle (no traffic), has predictable IP ID increments, and is reachable by you and the target. Avoid Windows machines (random IP IDs) or hosts with heavy traffic.
2. Probe the zombie: Send a SYN-ACK to the zombie. Since it's not expecting a connection, it replies with RST. Note the IP ID returned (call it A).
3. Send a spoofed probe to the target: Send a SYN packet to the target port with the source IP set to the zombie's IP. The target responds based on the port state: - Open port: Target responds with SYN-ACK to the zombie. - Closed port: Target responds with RST to the zombie. - Filtered: Target ignores the packet entirely.
4. Probe the zombie again: Send another SYN-ACK and check the new IP ID (B). Compare: if B - A is 2 (or more), the port is open; if 1, closed; if 0, filtered.

Hands-on Walkthrough

Let's put both techniques into practice using Nmap, the de facto tool for this. We'll assume you have a lab environment with VMs — never scan unauthorized targets!

Decoy Scan with Nmap

Run a SYN scan with decoys using the -D flag. Replace DECOY_IP with live IPs (you can use RND to let Nmap randomize).

# Decoy scan: real IP plus 5 decoys
nmap -sS -D DECOY1,DECOY2,DECOY3,DECOY4,DECOY5 <target_ip>

# Or mix your real IP with random decoys
nmap -sS -D RND:10 <target_ip>

Expected behavior: Nmap sends packets from each source. On the target, you'd see six source IPs performing a scan. If you have access to the target's logs, you'd see something like:

[IDS Alert] Port scan detected from 203.0.113.10 (and 5 others)
[IDS Alert] Port scan detected from 198.51.100.22
[IDS Alert] Port scan detected from 192.0.2.99
...

Notice no single IP stands out.

Idle Scan with Nmap

First, find a suitable zombie host. Use a ping or NULL scan to check if it's active and if its IP ID increments are predictable.

# Check if host is up (no need to be stealthy here)
nmap -Pn <zombie_ip>

# Use Nmap's idle scan with -sI
nmap -sI <zombie_ip> <target_ip>

Important: The zombie IP must be alive and idle. A busy host will have random IP ID jumps, making results unreliable.

Example output (target port 80 open):

Idle scan using zombie 10.0.0.5 (10.0.0.5:80)
PORT   STATE SERVICE
80/tcp open  http
MAC Address: 08:00:27:XX:XX:XX (Oracle VirtualBox)

Nmap reports the port state based on IP ID arithmetic. If it says "open", the zombie received a SYN-ACK and incremented its IP ID by 2 — exactly as expected.

Step-by-step on a lab

1. Set up a lab: Use VirtualBox with three VMs: attacker (Kali), target (Metasploitable), zombie (Ubuntu). Put them on a host-only network.
2. Confirm connectivity: Ping all three hosts.
3. Run a decoy scan as above.
4. Run an idle scan: Ensure the zombie is idle; turn off any background updates.
5. Verify on the target: Check the target's logs to see the decoy scan's multiple sources, and confirm the idle scan's source is the zombie IP, not yours.

Compare Options / When to Choose What

Variations and Alternatives

• Using -D ME: The ME option tells Nmap to include your real IP among decoys. Handy if you're testing whether your own IP can be identified. But it defeats the purpose if you're trying to hide completely.
• Using -S spoofing: You can spoof source IPs manually with -S SPOOFED_IP -e eth0. This is a simpler, less reliable form of evasion.
• Proxy chains: Tools like proxychains route your scans through SOCKS proxies, changing your exit IP. This is an alternative but slower and can break Nmap's scans.

Troubleshooting & Edge Cases

Decoy scan issues

• Decoys are down: If a decoy IP is dead, the target may notice a pattern. Use -D RND:N to mix randomly. Also, avoid using your real IP as a decoy unless you want it visible.
• IDS still detects you: Some IDS use statistical analysis to flag multiple sources sending identical patterns. To avoid this, vary packet sizes or use different timing (-T2 slower).
• Permission denied: Port scans often require root. Use sudo.

Idle scan issues

• Zombie IP ID is random: Some OSes (Windows) randomize IP IDs. Use a Linux/Unix zombie.
• Zombie is behind NAT: The IP ID is for the NAT device, not the zombie, so results may be inaccurate.
• Zombie is busy: If the zombie has outgoing traffic, IP ID jumps by more than 1, giving false results. Wait for quiet periods or use nmap -v to monitor.
• Target replies with RST to closed ports: That's expected. If you see "filtered", the target is dropping packets (e.g., firewall). Ensure your spoofed SYN reaches the target.

What You Learned & What's Next

You've now mastered two advanced techniques to evade detection during reconnaissance. You can explain the core idea behind decoy and idle scans, and you've completed a practical exercise using Nmap. You understand when to use decoys (for speed and simplicity) versus idle scans (for total anonymity). You also know common pitfalls and how to fix them.

In the next lesson in this track, you'll build on this foundation to tackle service enumeration — identifying what's actually running on those open ports. That's the logical next step after scanning: once you know a port is open, you need to know what service is listening and its version, which sets you up for vulnerability research and exploitation. You'll apply the same stealth mindset to keep your presence hidden while you gather even deeper intelligence.

Keep practicing in your lab — stealth is a skill that only improves with repetition. And remember: always work with authorization. These techniques are powerful, and with power comes responsibility.