How does P0F2 and Fl0p do passive fingerprinting?

a) By analyzing packet headers
b) By querying WHOIS databases
c) By listening to network traffic
d) By sending spoofed packets