 Because transmitted packets are numbered in a sequence you can say how many packets are transmitted between two packets that you receive.An attacker would first scan for a host with a sequential and predictable sequence number (IPID).The latest versions of Linux, Solaris, OpenBSD, and Windows Vista are not suitable as zombie, since the IPID has been implemented with patches that randomized the IPID.