Another clue for identifying these probes is that the same TCP sequence number is used for all seven of these probes. Besides just sending packets with different TCP flag settings, these packets also include several TCP options, something that I had noticed previously in network monitor output but not really understood. First, you can tell that options are present in a TCP header by examining the length field. This field normally has a value of 5, with a maximum value of 15. If it's greater than 5, some options are present at the end of the header.
Options begin with a kind field that identifies the type of options.
All other options consist of the kind, a length in bytes that includes the kind byte, and the actual data. The End of list always ends the options. Fyodor uses three options, plus a NOP for padding and the final end of list. The options are Window Scale, Maximum Segment Size, and Timestamp. The Maximum Segment Size is normally used by the sender to avoid fragmentation.