You work as a Penetration Tester for the Infosec Inc. Your company takes the projects of security auditing. Recently, your company has assigned you a…

The idle scan technique fundamentally relies on a "zombie" host that is not generating other network traffic, ensuring its IP Identification (IPID) field increments predictably. The scan's logic deduces port states by observing if the zombie's IPID increases by an extra step (total of 2) between probes. An unpredictable IPID that increments by more than one indicates the zombie is not idle. It is actively communicating with other systems, and each packet it sends increments its own IPID. This unrelated traffic "poisons" the scan results, as the penetration tester can no longer attribute IPID changes solely to their spoofed probes, making the scan unreliable.

B. A firewall blocking the scan would likely cause the spoofed packet to be dropped, resulting in no response to the zombie. The IPID would then increment by a consistent value of 1 (from the tester's probe), not unpredictably.

C. If the zombie were not connected to the target, the result would be the same as a firewall block: no response would be elicited, and the IPID would increment predictably by 1, not by multiple values.

D. This is factually incorrect. Hping is a powerful packet crafting tool that can be used to perform the steps of an idle scan, although Nmap is more commonly used for its automation of the process.

1. Nmap Official Documentation: In the description of the Idle Scan (-sI)

the documentation states: "A major issue with this scan type is that the zombie needs to be idle (hence the name). If it is carrying on a lot of unrelated traffic

its IP ID sequence will be scrambled

confusing Nmap." This directly confirms that interaction with other systems is the cause of unpredictable IPID increments.

Source: Nmap.org

"Firewall/IDS Evasion and Spoofing

" Section: "TCP Idle Scan (-sI)".

2. Academic Publication (Seminal Paper): The original paper introducing the idle scan technique highlights the necessity of an idle host. The entire method is predicated on the ability to control and observe the IPID changes

which is impossible if the host is generating its own traffic.

Source: Sanfilippo

S. (antirez). (1998). "Idle Scanning and Related IPID Games". Phrack Magazine

Volume 8

Issue 54

Article 8.

3. University Courseware: Lecture materials from computer security courses at reputable universities explain this requirement. For a successful idle scan

the zombie host must not be engaged in other communications

as this would introduce noise into the IPID sequence

rendering the scan results invalid.

Source: University of California

San Diego

CSE 127: Introduction to Computer Security

"Lecture 11: Network Security: Port Scanning

" Slide 29

"Idle Scan: Caveats". The slide notes: "If the zombie is not idle

its IP ID will be changing due to its own traffic

and the scan will not work."