How does the -D option implement decoy scans and what effect does that have on the target's logs?

• A. -D uses decoy IPs to obfuscate the true source; logs may show multiple sources, making correlation harder, though the scanner may still be identifiable by some systems.
• B. -D uses DNS spoofing to mislead logging.
• C. -D only changes the destination port ordering.
• D. -D disables decoy usage.

Answer: (A)

Using decoys with this option adds spoofed source IPs to each probe alongside your real address. What the target sees in its logs are probes coming from several different IPs, not just one. That spreads the activity across multiple sources and makes it harder to link all the log entries to a single scanner, which is the main purpose of decoying. At the same time, the true initiating host can still be inferred by some systems from other signals like timing patterns or traffic behavior, so attribution isn’t guaranteed to be complete.