You are manually conducting Idle Scanning using Hping2. During your scanning you notice that almost every query increments the IPID regardless of the port being queried. One or two of the queries cause the IPID to increment by more than one value. Why do you think this occurs?
A.
The zombie you are using is not truly idle.
B.
A stateful inspection firewall is resetting your queries.
C.
Hping2 cannot be used for idle scanning.
D.
These ports are actually open on the target system.
Explanation:
If the IPID is incremented by more than the normal increment for this type of system it means that the system is interacting with some other system beside yours and has sent packets to an unknown host between the packets destined for you.