What is the purpose of the --badsum option and when would you use it?

• A. --badsum sends legitimate packets to verify correct checksum handling.
• B. --badsum increases scan speed.
• C. --badsum sends packets with intentionally invalid checksums to try evading simplistic detection.
• D. --badsum modifies the target's checksum expectations.

Answer: (C)

This option is about testing how a network handles malformed traffic by using deliberately invalid checksums. By sending packets whose checksum fields are intentionally incorrect, you can see whether devices like firewalls or intrusion detection systems still respond, drop, or log the traffic. Some systems only perform superficial checks and may let bad-checksum packets through, while properly validating stacks will drop them. This helps you assess whether any detection or filtering is relying on checksum validity and how a target might react to evasion attempts.

That’s why the best description is that it sends packets with intentionally invalid checksums to try evading simplistic detection. It’s not about sending legitimate traffic, increasing speed, or changing the target’s expectations—it's a diagnostic probe of how traffic with bad checksums is treated by the network and security devices. Use with care, as malformed packets can provoke abnormal or disruptive responses.