What is the purpose of the -D decoy option, and what are potential caveats?

• A. It uses decoy IPs to impersonate other hosts and confuse logs.
• B. It only changes the timing of probes.
• C. It adds decoy addresses to the scan to confuse logs; this may violate policy and trigger IDS.
• D. It disables normal host discovery.

Answer: (C)

The main idea behind this option is to make the scan appear as if it’s coming from multiple hosts by adding decoy IP addresses to the probe stream. That way the target’s logs show several source addresses, making it harder to attribute the scan to a single origin. This is why it’s described as adding decoy addresses to confuse logs.

There are important caveats to keep in mind. Many networks implement anti-spoofing measures and may drop spoofed packets or flag the activity as suspicious, which can alert defenders or disrupt the scan. Using decoys can trigger IDS/IPS alerts and potentially violate organizational policy or legal constraints. It can also create collateral noise for decoy hosts and complicate log analysis for both you and the network owners. In short, while the feature can obscure attribution, it carries real risks and should be used only with proper authorization and awareness of policy implications.