What is the purpose of the -e option and the -S/--source-address options, and when would you use them?

• A. -e selects the interface.
• B. -e selects the interface; -S sets the source IP address for probes or spoofing; use to control path or evade simple filters.
• C. -S enables stealth scanning.
• D. -S sets the source port for outbound probes.

Answer: (B)

This probes your ability to control how the scan leaves your machine and what source address it uses. The -e option binds Nmap to a specific network interface. This is essential when a host has multiple interfaces (for example, a wired and a wireless card, or a VPN tunnel) and you need the scan to go out through the correct path or reach a target on a particular network.

The -S or --source-address option sets the source IP address that appears in the probes. This lets you influence the network path (some networks route or filter traffic based on the source address) and test how filters behave with different sources. It can even be used to simulate traffic from a given IP. Because replies go to the source address, you won’t see responses on your scanner unless the route returns to you, so use this when you specifically want to test path or filter behavior rather than to get direct test results back.

In short, these switches give you precise control over which interface is used and what source IP the probes appear to come from, which is why you’d use them in multi-homed setups or when testing routing and filtering policies.