If an attacker's IPID of 31400 to a zombie on an open port in IDLE scanning, what will be the response?

If an attacker's IPID of 31400 to a zombie on an open port in IDLE scanning, what will be the response?

• A. 31402
• B. The zombie will not send a response
• C. 31401
• D. 31399

Answer: (C)

In IDLE scanning, the IP Identification (IPID) field is used as a side channel. The attacker uses a zombie host with a predictable IPID sequence and sends spoofed probes that appear to come from that zombie to the target. If the target port is open, the target will respond to the zombie, causing the zombie to generate or relay one more IP packet. This increases the zombie’s IPID by one. Therefore, starting from an observed IPID of 31400, the next value the zombie will emit after the probe is 31401. If the port were closed or filtered, the IPID behavior would differ (often no the same incremental response), so the open-port case specifically leads to a single increment.

In IDLE scanning, the IP Identification (IPID) field is used as a side channel. The attacker uses a zombie host with a predictable IPID sequence and sends spoofed probes that appear to come from that zombie to the target. If the target port is open, the target will respond to the zombie, causing the zombie to generate or relay one more IP packet. This increases the zombie’s IPID by one. Therefore, starting from an observed IPID of 31400, the next value the zombie will emit after the probe is 31401. If the port were closed or filtered, the IPID behavior would differ (often no the same incremental response), so the open-port case specifically leads to a single increment.