How does nmap do first-generation active OS fingerprinting?

a) By analyzing packet timing
b) By querying the target's DNS records
c) By analyzing TCP/IP stack responses
d) By sending malformed packets