1 research outputs found
Sundials in the Shade: An Internet-wide Perspective on ICMP Timestamps
ICMP timestamp request and response packets have been standardized for nearly
40 years, but have no modern practical application, having been superseded by
NTP. However, ICMP timestamps are not deprecated, suggesting that while hosts
must support them, little attention is paid to their implementation and use. In
this work, we perform active measurements and find 2.2 million hosts on the
Internet responding to ICMP timestamp requests from over 42,500 unique
autonomous systems. We develop a methodology to classify timestamp responses,
and find 13 distinct classes of behavior. Not only do these behaviors enable a
new fingerprinting vector, some behaviors leak important information about the
host e.g., OS, kernel version, and local timezone.Comment: Passive and Active Measurements (PAM) 201