As stated by other posters, the best "passive" way to determine this is via stack operations. ( sequencing, etc ), which is best done "off router" due to the specific nature ( active ). Is it not possible to write a custom IDS signature that will analyse similar footprints ( passively ) as nmap.