During an authorized external assessment, a penetration tester wants to enumerate open ports on a target host while making it difficult for the target's SOC to identify which source IP is the true origin of the scan. The tester decides to use a zombie host with predictable IP ID sequence numbers to bounce the scan off of, so the target never receives packets directly from the tester's real address. Which Nmap technique should the tester use?