What firewall evasion scanning technique make use of a zombie system that has low network activity as well as its fragment identification numbers?

Decoy scanning obscures the real scanner by mixing spoofed source IPs into the scan traffic, but it does not use a zombie host or rely on monitoring fragment identification numbers to infer port state.

Packet fragmentation scanning splits TCP/IP headers across multiple small packets to bypass stateless firewall inspection, and has no dependency on a zombie system or IP ID analysis.

Spoof source address scanning simply forges the source IP on outgoing packets but does not involve selecting a zombie with low activity or measuring its IP ID increments to determine target port status.

Idle scanning exploits a zombie system that has very low network activity so its IP ID numbers increment predictably and in isolation. The attacker probes the zombie's IP ID before and after sending a spoofed SYN packet to the target on the victim's behalf - if the zombie's IP ID increments by 2, the target port is open; by 1, it is closed - all without the attacker's IP address appearing in any target logs.