You are manually conducting Idle Scanning using Hping2. During your scanning you notice that almost every query increments the IPID regardless of the port being queried. One or two of the queries caus

Idle scanning relies on a zombie host that is completely idle so its IP ID counter only increments in direct response to your injected probe packets. When the IPID jumps by more than 1 between measurements, it means the zombie is independently sending packets to other hosts, corrupting the side-channel measurement and producing false results. A truly idle zombie should show IPID increments of exactly 0 (closed port) or 1 (open port) per probe cycle.

A stateful inspection firewall operates between your scanner and the target, blocking or resetting packets at that boundary - it would not cause the zombie host's own IPID counter to increment unexpectedly.

Hping2 is specifically capable of performing idle scanning through custom packet crafting with spoofed source addresses, and this is a documented use case for the tool.

An open port on the target sends a SYN-ACK to the zombie, which responds with a single RST packet, incrementing the zombie's IPID by exactly 1 - not by more than 1.