25

You are running an IDLE scan using hping2.

As the scan continues, you note the IPID is increamenting randomly.

What does this tell you?


your target machine is not an IDLE zombie;
it is active on the network with other tasks.


An IDLE scan makes use of a zombie system that is inactive on the network, using the resulting IPID numbers for scan results.


If the numbers increment randomly, then the zombie is not truly idle.


The results have nothing to do with a firewall,

this scan cannot tell you which OS is running, and

this is not the expeted behavior from an idle zombie.