# The origins of the Idle Scan

DevFeed: [The origins of the Idle Scan](<https://devfeed.tech/articles/the-origins-of-the-idle-scan-20630.md>)

Original publisher: [Read original article](<http://antirez.com/news/139>)

Published: 2023-10-19T10:40:27Z

Content type: article

Language: en

Sources: [Antirez](<https://devfeed.tech/sources/antirez.md>)

Topics: [Network](<https://devfeed.tech/topics/network.md>), [TCP/IP](<https://devfeed.tech/topics/tcp-ip.md>), [Operating system](<https://devfeed.tech/topics/operating-system.md>), [Tool](<https://devfeed.tech/topics/tool.md>), [Protocol (disambiguation)](<https://devfeed.tech/topics/protocol.md>)

Tags: [attacks](<https://devfeed.tech/tags/attacks.md>), [network](<https://devfeed.tech/tags/network.md>), [operating-systems](<https://devfeed.tech/tags/operating-systems.md>), [protocol](<https://devfeed.tech/tags/protocol.md>), [research](<https://devfeed.tech/tags/research.md>), [tcp](<https://devfeed.tech/tags/tcp.md>), [tcp-ip](<https://devfeed.tech/tags/tcp-ip.md>), [tool](<https://devfeed.tech/tags/tool.md>), [udp](<https://devfeed.tech/tags/udp.md>)

## AI overview

The article recounts how the Idle scan originated in 1998 through experimentation with Hping, a tool for crafting unusual TCP/IP packets. It explains that observing incrementing IP ID values revealed a universal outgoing-packet counter in operating systems, which could be used to estimate a networked computer's outgoing traffic.

## Source excerpt

The Idle scan was conceived at the end of 1998, evidenced by emails. I had moved to Milan a few months prior, having been there since September if I recall correctly, brimming with new ideas, unaware that my stay in that city would be brief. I spent the summer on the beaches of Sicily, mainly occupied with reading many books recommended by the folks at Seclab (mostly by David). However, those readings needed a catalyst: the Idle scan was an attack born from theoretical rumination, but the stream of thoughts originated from a rather practical circumstance. I had recently created Hping, a tool whose logo was borrowed from that of Nutella. I mention this to emphasize the seriousness that governed my efforts at that time -- after all, I was only twenty-one and already in Northern Italy with a full-time job on my shoulders; some understanding was warranted. Hping was a Swiss Army knife for the TCP/IP protocol. Its initial use was mostly exploratory, for research. With Hping, you could assemble TCP, UDP, and ICMP packets in the most bizarre manner, and encapsulate them in equally eccentric IP packets, fragmented, with fields set to anomalous values. These packets were sent around to observe the network stack response of different operating systems. This is where Idle scan originates: playing with Hping for just a few minutes revealed a well-known yet (to me) surprising fact. The response packets had an ID field that continuously incremented by some measure. At that time, given that the attacks I would later disclose were not yet known, this ID field behavior aroused no concern. Every time an operating system emitted an IP packet, it first incremented a counter (which reset to zero once it reached the maximum value of two to the sixteenth power minus one), then the packet was sent with the ID set to the counter's value. The counter was universal for all outgoing packets. This allowed, for starters, to estimate the outgoing traffic of any networked computer. This information