Question:

You are doing an IDLE scan and have sent the first packet to the target machine. The zombie is then sent the SYN/ACK packet. The IPID on the zombie's return packet is 36754. What is the state of the port on the target system if the beginning IPID was 36753?

A Closed

explanation

This suggests the zombie hasn't transmitted anything since your initial SYN/ACK to determine the beginning IPI since the IPID was only increased by one. If the IPID had grown by two, the port would be open because the zombie would have responded to the target machine's SYN/ACK.

You are doing an IDLE scan and have sent the first packet to the target machine. The zombie is then sent the SYN/ACK packet. The IPID on the zombie's return packet is 36754. What is the state of the port on the target system if the beginning IPID was 36753?

Related Information