TCP/IP stack fingerprinting is the passive collection of configuration attributes from a remote device during standard layer 4 network communications. Which of the following tools can be used for pass

nmap performs active OS fingerprinting by sending specially crafted probe packets to the target and analyzing responses, making it an active tool.

ping actively generates and sends ICMP echo request packets to a target host, which is an active rather than passive technique.

tracert (traceroute) actively sends packets with incrementing TTL values to discover network hops and is therefore an active tool.

tcpdump passively captures raw network packets off the wire without injecting any traffic. By inspecting TCP/IP header fields such as TTL values, window sizes, and TCP option ordering in captured packets, an analyst can infer the remote host's operating system. This is the definition of passive fingerprinting - observing traffic already in transit.