You are manually conducting Idle Scanning using Hping2. During your scanning you notice that almost every query increments the IPID regardless of the port being queried. One or two of the queries caus

The idle scan technique relies on using a truly idle zombie - a host that sends no traffic of its own - so that IPID increments can be attributed solely to forged packets bounced from the target. If the zombie is sending its own packets, its IPID increments regardless of the target port's state, making nearly every probe appear to cause an increment. This corrupts the scan results and indicates the chosen zombie is actively communicating on the network.

A stateful inspection firewall would drop or reject packets but would not cause the zombie's own IPID counter to increment independently of the scan.

Hping2 is a well-established tool specifically capable of performing idle scans by forging source IPs and monitoring zombie IPID values.

Open ports on the target cause the zombie's IPID to increment by exactly 2 for specific probes, not a near-universal increment across all queries.