Interpreting IPID Increment in Nmap IDLE Scans
A Certified Ethical Hacker (CEH) is analyzing a target network. To do this, he decides to utilize an IDLE/IPID header scan using Nmap. The network analysis reveals that the IPID number increases by 2 after following the steps of an IDLE scan. Based on this information, what can the CEH conclude about the target network?
Community Votes
83% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The core concept tested is the mechanics of passive port scanning using a zombie host; the common trap is confusing an IPID increment of 1 (closed/filtered) with 2 (open).
This question explores the interpretation of IP Identification (IPID) header increments during an Nmap IDLE scan. An increment of 2 indicates that the zombie host sent a packet between probes, confirming that the target port is open.
Many users incorrectly select 'Stateful firewall present' because they assume any change in IPID implies state tracking, failing to recognize that an increment of exactly 2 is the specific signature of an open port response from the zombie.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
An IDLE scan relies on a 'zombie' host with predictable IPID behavior. When the scanner sends a probe to the target, if the target port is open, the target replies to the zombie's spoofed source address. This reply causes the zombie's IPID to increment by 1. The second probe sent by the scanner causes another increment. Thus, an observed increment of 2 between two scans of the zombie confirms the target port is open.Why the Other Options Are Wrong
Option B is incorrect because firewalls do not prevent the zombie from processing packets; they might block the final connection, but the IPID logic remains based on the zombie's activity. Option C is wrong because a closed or filtered port would result in no reply to the zombie, leading to an IPID increment of only 1 (from the second probe alone). Option D is a distractor; while firewalls exist, the IPID+2 specifically signals an open port, not the presence of a firewall.Community Comment Notes
Community consensus strongly favors option A. As user 'nicejob' noted, "IPID+2 mean target port is opened." User 'killwitch' explained that the technique exploits predictable IPID values to infer open ports without direct interaction. User 'ehsarx' confirmed that an increase of two indicates the zombie sent a packet between probes, which happens when the port is open. Only one user suggested a firewall, which contradicts the standard CEH doctrine for this specific metric.Exam Strategy
Memorize the IPID delta values: +1 means closed/filtered, +2 means open. In IDLE scans, the key is understanding that the 'open' signal comes from the zombie receiving a reply from the target, not from the scanner directly hitting the target.
Frequently Asked Questions
Why does IPID increment by 2 indicate an open port?
The first probe causes the zombie to send a packet (increment 1). If the port is open, the target replies to the zombie, causing a second increment. The second probe adds a third increment, but we measure the difference between the two initial states, showing a net change of 2.
Can a stateful firewall hide an open port in an IDLE scan?
No, the IDLE scan uses a zombie host. The firewall's effect on the zombie's IPID is minimal if the zombie is chosen correctly. The IPID+2 specifically reflects the zombie's activity triggered by the target's response.