In the network logs there are ACK/FIN/PSH/URG packets from a host going to a closed port, and SYN/FIN/URG/PSH packets going to open ports. What is the host likely doing?

Active OS fingerprinting specifically examines response characteristics such as TTL values, TCP window sizes, and option ordering to identify the underlying operating system, which is a deeper analysis than simply probing port states with unusual flags.

Probing both closed and open ports with various unusual flag combinations is characteristic of a host discovery sweep - closed ports that receive unexpected flag combinations typically respond with RST packets, confirming the host is alive. The systematic targeting of both port states across multiple flag combos indicates the goal is to map out responsive hosts and port availability rather than to extract OS stack details or evade a specific detection rule.

Passive OS fingerprinting involves analyzing existing traffic without sending any packets, so a host that is actively transmitting probe packets cannot be performing passive fingerprinting by definition.

IDS evasion involves crafting packets specifically to bypass detection signatures, but systematically probing both open and closed ports across multiple flag combinations is more indicative of active scanning than a targeted evasion strategy.