Another trick for picking up these probes is that the same TCP sequence number is used for all seven of these probes. Besides just sending packets with different TCP flag settings, these packets also include several TCP options, something that I had noticed before in network monitor output, but not really understood. Digging into the RFCs, I found several references to TCP options, but the most important for understanding what nmap is doing was RFC 1323 . First, you can tell that options are present in a TCP header by examining the length field. This field is normally five, but if it is greater, than some options are present at the end of the header.
Options begin with a 'kind' field that identifies the type of options.
All other kinds of options consist of the kind, a length in bytes that includes the kind byte, and the actual data. The NOP is used to align the data in options into 32 bit words, or to fill out a 32 bit word. The end of list always ends the options. Fyodor uses three options, plus a nop for padding and the final end of list. The options are window scale, maximum segment size, and timestamp.