Interpreting IPID Increment in Nmap IDLE Scans
Short answer
A The ports on the target network are open, as an IPID increment of 2 confirms the zombie host received a reply from the target.
Question
Key Takeaways
The core concept tested is the mechanics of passive port scanning using a zombie host; the common trap is confusing an IPID increment of 1 (closed/filtered) with 2 (open).
This question explores the interpretation of IP Identification (IPID) header increments during an Nmap IDLE scan. An increment of 2 indicates that the zombie host sent a packet between probes, confirming that the target port is open.
Common mistake: Many users incorrectly select 'Stateful firewall present' because they assume any change in IPID implies state tracking, failing to recognize that an increment of exactly 2 is the specific signature of an open port response from the zombie.
Expert Analysis
Why the Answer Is Correct
An IDLE scan relies on a 'zombie' host with predictable IPID behavior. When the scanner sends a probe to the target, if the target port is open, the target replies to the zombie's spoofed source address. This reply causes the zombie's IPID to increment by 1. The second probe sent by the scanner causes another increment. Thus, an observed increment of 2 between two scans of the zombie confirms the target port is open.
Why the Other Options Are Wrong
Option B is incorrect because firewalls do not prevent the zombie from processing packets; they might block the final connection, but the IPID logic remains based on the zombie's activity. Option C is wrong because a closed or filtered port would result in no reply to the zombie, leading to an IPID increment of only 1 (from the second probe alone). Option D is a distractor; while firewalls exist, the IPID+2 specifically signals an open port, not the presence of a firewall.
Community Comment Notes
Community consensus strongly favors option A. As user 'nicejob' noted, "IPID+2 mean target port is opened." User 'killwitch' explained that the technique exploits predictable IPID values to infer open ports without direct interaction. User 'ehsarx' confirmed that an increase of two indicates the zombie sent a packet between probes, which happens when the port is open. Only one user suggested a firewall, which contradicts the standard CEH doctrine for this specific metric.
Exam Strategy
Memorize the IPID delta values: +1 means closed/filtered, +2 means open. In IDLE scans, the key is understanding that the 'open' signal comes from the zombie receiving a reply from the target, not from the scanner directly hitting the target.
Frequently Asked Questions
Why does IPID increment by 2 indicate an open port?
Can a stateful firewall hide an open port in an IDLE scan?
Community Votes
83% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
nicejob 👍 3 Answered AIPID+2 mean target port is opened
-
killwitch 👍 1 Answered AAn IDLE/IPID header scan is a stealthy port scanning technique that exploits predictable IP identification (IPID) values from a zombie host to infer open ports on a target system without directly interacting with the target. How an IDLE Scan Works: The attacker finds a zombie host (a machine with predictable IPID values). The attacker sends a SYN packet to the target spoofed as coming from the zombie. The target responds: If the port is open, the target replies to the zombie with a SYN/ACK. Since the zombie was unaware of the connection, it sends an RST response, increasing its IPID value by 2. If the port is closed, the target replies with an RST, which does not cause the zombie's IPID value to increment by 2. Since the IPID increased by 2, this means the target responded with a SYN/ACK, causing the zombie to send an RST—indicating that the port is open.
-
Dogeo 👍 1 Answered DThe IDLE scan in Nmap reveals that the IPID number increases by 2, which indicates that the target network is likely protected by a stateful firewall. This type of firewall tracks connection states and influences how the IPID field is modified, providing clues about the network's configuration.
-
ehsarx 👍 1 Answered Aan IPID increase of two indicates that a zombie host sent a packet between two probes. This usually means that the port is open.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.