A Certified Ethical Hacker (CEH) is analyzing a target network. To do this, he decides to utilize an IDLE/IPID header scan using Nmap. The network analysis reveals that the IPID number increases by…

Question

Options

• AThe ports on the target network are open
• BThe target network has no firewall present
• CThe ports on the target network are closed
• DThe target network has a stateful firewall present

• A
  79% (15)
• B
  5% (1)
• C
  5% (1)
• D
  11% (2)

Explanation

IDLE/IPID Scan Explanation

In an IDLE scan, the IPID (IP Identification) number of a zombie host increments by 2 when a target port is open - this happens because the target sends a SYN/ACK to the zombie (incrementing its IPID by 1), and then Nmap probes the zombie again to check its IPID (incrementing it by 1 more), confirming the port responded. Option B is incorrect because firewall presence cannot be determined solely by an IPID increment of 2; Option C is incorrect because a closed port causes the IPID to increment by only 1 (the target sends a RST, causing no response from the zombie, so only Nmap's probe increments it); Option D is incorrect because a stateful firewall would more likely block or drop packets, which would also result in only a +1 increment, similar to a filtered port scenario.

Memory Tip: Think "2 = Two-way conversation = Open!" - an open port generates two extra IPID increments (target replies to zombie + Nmap checks zombie), while a closed port only generates one.

No community discussion yet for this question.