Which of the following command line switch would you use for OS detection in Nmap?

-D enables decoy scanning, which inserts fake source IP addresses alongside the real scanner's IP in probe packets to obscure the attacker's true origin.

The -O switch instructs nmap to perform active OS fingerprinting by sending specially crafted TCP, UDP, and ICMP probes and analyzing target responses including TTL values, TCP window sizes, IP ID sequences, and other TCP/IP stack behaviors. Nmap then compares these observed characteristics against its fingerprint database to determine the most likely operating system running on the target host.

-P controls ping and host discovery methods (for example -Pn disables ping to treat all hosts as up) and has no role in OS detection.

-X is not a recognized or valid nmap command line switch and performs no function in nmap.