IDLE/IPID Header Scan IPID Increment Analysis
A Certified Ethical Hacker (CEH) is analyzing a target network. To do this, he decides to utilize an IDLE/IPID header scan using Nmap. The network analysis reveals that the IPID number increases by 2 after following the steps of an IDLE scan. Based on this information, what can the CEH conclude about the target network?
Community Votes
69% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The core concept tested is the mathematical relationship between IPID changes and port states in idle scanning, with the common trap being confusion between the +1 (closed) and +2 (open) increment rules.
This question explores the interpretation of IP Identification (IPID) increments during an Nmap IDLE scan to determine target port status. It establishes that an increment of 2 specifically indicates open ports on the target host via a zombie scanner.
Many candidates select D (Stateful Firewall), mistakenly believing that any deviation from the standard +1 increment implies firewall activity rather than the specific logic of the idle scan mechanism.
Community Discussion (10 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
In an IDLE scan, the attacker uses a 'zombie' host to probe the target. If the target port is open, the zombie receives a SYN+ACK from the target, causing its IPID to increment by 1. The zombie then sends an RST back to the attacker, using the next IPID value. Consequently, the difference between the initial and final IPID observed by the attacker increases by 2. This specific behavior confirms the port is open.Why the Other Options Are Wrong
Option C is incorrect because closed ports typically result in an IPID increment of 1 (the zombie ignores the packet and only increments for its own traffic). Option B is incorrect because firewalls do not prevent this side-channel analysis if the zombie is reachable. Option D is a distractor; while stateful firewalls affect packet tracking, the +2 increment is a deterministic signature of an open port in this specific scan type, not a general indicator of a firewall presence.Community Comment Notes
Community consensus heavily favors A, citing the CEH v12 textbook page 317 which explicitly links the +2 increment to open ports. Some users like brrbrr argue for D, suggesting firewall normalization causes the change, but this contradicts the fundamental mechanics of the IDLE scan where the zombie's reaction to the target determines the count. Comments referencing the Nmap documentation confirm that the +2 delta is the hallmark of an open port response.Official Reference
Exam Strategy
Memorize the specific IPID deltas for IDLE scans: +1 means closed/filtered, and +2 means open. Do not overthink firewall interactions unless the question explicitly mentions packet filtering blocking the zombie's responses.
Frequently Asked Questions
Why does an IPID increment of 1 indicate a closed port?
When a port is closed, the zombie ignores the probe. Its IPID only increments due to its own background network traffic, resulting in a +1 change.
Can a stateful firewall cause an IPID increment of 2?
No. While firewalls track connections, the +2 increment is a direct result of the zombie receiving a response from the target server, indicating an open port.