What type of OS fingerprinting technique sends specially crafted packets to the remote OS and analyzes the received response?

Passive OS fingerprinting only monitors and analyzes traffic already flowing on the network without sending any crafted packets to the target, making it stealthier but dependent on existing traffic.

Active OS fingerprinting tools such as Nmap send deliberately unusual or malformed TCP/IP packets - for example, packets with specific flag combinations or out-of-spec options - and measure how the target OS responds, because each OS implements the TCP/IP stack differently. These behavioral differences in responses, such as window size, TTL values, and handling of edge-case flags, allow the tool to match the response profile to a known OS signature database. This technique requires actively generating and injecting traffic, which distinguishes it from passive fingerprinting that only observes existing network traffic.

Reflective is not a recognized category in OS fingerprinting methodology and does not correspond to any standard technique.

Distributive is not a recognized category in OS fingerprinting methodology and does not correspond to any standard technique.