Nmap: Network Exploration and Security Auditing Cookbook - Second Edition

Getting ready

To launch an idle scan, we need a zombie host. A zombie host is a machine with a predictable IP ID sequence number that will be used as the spoofed IP address. A good candidate must not be communicating with other hosts in order to maintain the correct IP ID sequence number and avoid false positives.

To find hosts with an incremental IP ID sequence, you could use the ipidseq script as follows:

#nmap -p80 --script ipidseq <your ip>/24#nmap -p80 --script ipidseq -iR 1000  

Possible candidates will return Incremental in the script's output section:

   Host is up (0.28s latency).    PORT   STATE SERVICE    80/tcp open  http     Host script results:    |_ipidseq: Incremental!