Which of the following is a passive information gathering tool?

Whois queries public registration databases maintained by organizations such as ARIN, ICANN, and regional internet registries to obtain domain ownership, IP allocation, registrar, and contact details. Because all queries are directed at third-party registries rather than at the target system itself, no packets are sent to the target and the activity remains passive. This makes Whois a foundational open-source intelligence (OSINT) tool used in the reconnaissance phase of security assessments.

Snort is an active network intrusion detection and prevention system that inspects live packet traffic in real time, not a passive information gathering tool.

Ettercap is an active network interception tool used to perform man-in-the-middle attacks and capture or manipulate live network sessions.

Nmap actively transmits probe packets directly to target hosts and ports to enumerate open services, classifying it as an active scanning tool.