 This is how an attacker would find out if the targets port is open.The attacker will send another packet to the zombie.If the IPID is incremented only by a step then the attacker would know that the particular port is closed.