You are conducting an idlescan manually using HPING2. During the scanning process, you notice that almost every query increments the IPID- regardless of the port being queried. One or two of the queries cause the IPID to increment by more than one value. Which of he following options would be a possible reason?
A.
Hping2 can’t be used for idlescanning
B.
The Zombie you are using is not truly idle
C.
These ports are actually open on the target system
D.
A stateful inspection firewall is resetting your queries
Explanation:
If the IPID increments more than one value that means that there has been network traffic between the queries so the zombie is not idle.