Which technique is used to bypass IDS/firewalls by manipulating port numbers to evade rules?

Which technique is used to bypass IDS/firewalls by manipulating port numbers to evade rules?

• A. Source Routing
• B. Source Port Manipulation
• C. IP Address Decoy
• D. IP Address Spoofing

Answer: (B)

This question is about evading IDS/Firewall rules by exploiting how those devices use port numbers to classify traffic. Many security devices filter traffic based on the port numbers in the transport layer (for example, which service the traffic is trying to reach) and may also use the source port as part of their stateful tracking. By manipulating the source port, an attacker can make a packet appear to belong to a different flow or fall outside a rule’s expected pattern, allowing the traffic to slip past a rule set or avoid triggering certain detections. This kind of manipulation targets the port field itself rather than the IP addresses or the route taken. Source routing would change the path the packet takes and is not about port numbers. IP address decoy or IP address spoofing focus on misleading the destination about where the traffic is coming from, not on altering port values.

This question is about evading IDS/Firewall rules by exploiting how those devices use port numbers to classify traffic. Many security devices filter traffic based on the port numbers in the transport layer (for example, which service the traffic is trying to reach) and may also use the source port as part of their stateful tracking. By manipulating the source port, an attacker can make a packet appear to belong to a different flow or fall outside a rule’s expected pattern, allowing the traffic to slip past a rule set or avoid triggering certain detections. This kind of manipulation targets the port field itself rather than the IP addresses or the route taken.

Source routing would change the path the packet takes and is not about port numbers. IP address decoy or IP address spoofing focus on misleading the destination about where the traffic is coming from, not on altering port values.