Which of the following tools can be used for passive OS fingerprinting?

tcpdump is a passive packet capture utility that listens on a network interface without generating any probe traffic of its own - it can be used alongside tools like p0f to examine TCP/IP stack characteristics such as TTL values, window sizes, and TCP options in captured packets to infer remote host operating systems without alerting the target.

nmap actively sends crafted probe packets and analyzes responses for OS fingerprinting via its -O flag, making it an active reconnaissance tool, not a passive one.

ping actively transmits ICMP echo request packets to a target host, which constitutes active probing rather than passive traffic observation.

tracert actively injects packets with incrementing TTL values to map the network path to a destination, which is an active technique incompatible with passive fingerprinting.