One of your team members is analyzing TTL fields and TCP window sizes in order to fingerprint the OS of a target. Which of the following is most likely being attempted?

In general, any action stated in a query that does not directly specify you are constructing packets and injecting them into a system shows you are passively observing traffic—most likely using a sniffed traffic log.