Which concept refers to generating or manually specifying IP addresses of decoys to evade IDS/firewalls?

Which concept refers to generating or manually specifying IP addresses of decoys to evade IDS/firewalls?

• A. IP Address Spoofing
• B. Direct TTL Probes
• C. IP Address Decoy
• D. Anonymizers

Answer: (C)

Generating or configuring fake IP addresses to act as decoys is about creating counterfeit endpoints on a network to mislead monitoring systems. By establishing a set of decoy IPs, traffic can be funneled toward those addresses, drawing alerts and attention away from the real targets. This can flood or confuse IDS/firewalls so defenders spend time investigating decoy activity rather than the actual intrusion, helping the tester gauge detection coverage and response. This differs from IP address spoofing, which focuses on making packets appear to originate from a different source, rather than introducing separate, fake endpoints. Direct TTL probes involve using TTL values to fingerprint or map the network, not decoy creation. Anonymizers route traffic through intermediaries to hide the caller’s identity, rather than placing fake hosts within the target network.

Generating or configuring fake IP addresses to act as decoys is about creating counterfeit endpoints on a network to mislead monitoring systems. By establishing a set of decoy IPs, traffic can be funneled toward those addresses, drawing alerts and attention away from the real targets. This can flood or confuse IDS/firewalls so defenders spend time investigating decoy activity rather than the actual intrusion, helping the tester gauge detection coverage and response.

This differs from IP address spoofing, which focuses on making packets appear to originate from a different source, rather than introducing separate, fake endpoints. Direct TTL probes involve using TTL values to fingerprint or map the network, not decoy creation. Anonymizers route traffic through intermediaries to hide the caller’s identity, rather than placing fake hosts within the target network.