Идентификационное поколение последовательности IP

Just had a quick look at the nmap source code. This is a result of an attempt to fingerprint a host (determine what operating system it is running, and so forth). One of the techniques is to watch the pattern of IP IDs as packets are being sent back from the host. Each OS uses different techniques for changing those IDs, and if the pattern can be determined it can help identify the host characteristics. All that error means is either nmap couldn't determine a specfic pattern (unknown class) or it was getting sufficient responses from the host (busy server). You can have a look at the nmap source code yourself to be more definitive, or else read more of the description of nmap fingerprinting techniques at http://nmap.org/book/osdetect-methods.html

The IP ID sequence generation fingerprint measures how the IPv4 Identification field (bytes 32-47 in the IP header) is changed from one packet to the next. Nmap does this by collecting a series of IP headers and subtracting the value of each ID field from the next one to get an array of differences. Then it attempts to classify the algorithm by which the target OS is generating new IDs.

Nmap will return the message you are seeing if:

• there are not enough samples to classify the algorithm (less than 3 samples)
• the algorithm doesn't match any of the most common ones (Duplicated, Incremental, Broken incremental, Randomized, Randomized positive, or All zeroes), or
• the packets collected were interspersed with packets for other destinations

That last one is why the message says "Busy server." Since the ID field is changed for each packet, no matter which destination (i.e. packets that we don't see, since they go somewhere else), then if the target is communicating with other hosts, it will break up the sequence and make analysis impossible. This is why Idle scanning needs a "zombie" middleman that is not communicating with other hosts.

See the Nmap book's section on IP ID sequence generation algorithm fingerprinting, or the source code for more details.