Which of the following could be classified as a normal anomaly?

a$.)$ A connection between two hosts on the network suddenly goes down leaving the connection open.

b$.)$ A RESET $($RST$)$ state showing the ports closed though they are actually open.

c$.)$ A SYN scan looking at $1000$ well$-$known ports on a single host.

d$.)$ An improperly tuned and configured IDS.