You are conducting an idlescan manually using HPING2. During the scanning process, you notice that almost every query increments the IPID- regardless of the port being queried. One or two of the queries cause the IPID to increment by more than one value. Which of he following options would be a possible reason?

A.
Hping2 can’t be used for idlescanning

B.
The Zombie you are using is not truly idle

C.
These ports are actually open on the target system

D.
A stateful inspection firewall is resetting your queries

Explanation:
If the IPID increments more than one value that means that there has been network traffic between the queries so the zombie is not idle.