You are manually conducting Idle Scanning using Hping2. During your scanning you notice that almost every query increments the IPID regardless of the port being queried. One or two of the queries…

In an idle scan, the attacker monitors the zombie's IPID sequence to infer port state on the target. If the IPID increments by more than one between probes, it means the zombie host is receiving and responding to traffic from other sources, invalidating the scan's assumption of idleness and producing inaccurate results.

A stateful inspection firewall would block or reset connections, but this would affect whether responses are received at all - it would not cause the zombie's own IPID counter to increment by extra values.

Hping2 is a valid and commonly used tool for performing idle scanning; it supports crafting raw TCP packets with spoofed source addresses required for the technique.

Open ports on the target cause the target to send a SYN-ACK to the zombie (incrementing the zombie's IPID by one), not by more than one - a jump greater than one is caused by external traffic to the zombie, not by the target's port state.