Vulnerability & Exploit Database

Back to search

IPID Sequence Scanner

This module will probe hosts' IPID sequences and classify them using the same method Nmap uses when it's performing its IPID Idle Scan (-sI) and OS Detection (-O). Nmap's probes are SYN/ACKs while this module's are SYNs. While this does not change the underlying functionality, it does change the chance of whether or not the probe will be stopped by a firewall. Nmap's Idle Scan can use hosts whose IPID sequences are classified as "Incremental" or "Broken little-endian incremental".

Free Metasploit Download

Get your copy of the world's leading penetration testing tool

 Download Now

Module Name



  • kris katterjohn <katterjohn [at]>



Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use auxiliary/scanner/ip/ipidseq msf auxiliary(ipidseq) > show actions ...actions... msf auxiliary(ipidseq) > set ACTION <action-name> msf auxiliary(ipidseq) > show options and set options... msf auxiliary(ipidseq) > run