 It should be idle (hence the scan name), as extraneous traffic will bump up its IP ID sequence, confusing the scan logic.The lower the latency between the attacker and the zombie, and between the zombie and the target, the faster the scan will proceed.Note that when a port is open, IPIDs increment by 2.