[ntp:questions] Re: Fingerprinting hosts by clock skew

Brad Knowles brad at stop.mail-abuse.org
Thu Mar 10 09:41:56 UTC 2005

At 10:34 AM +0100 2005-03-10, Mxsmanic wrote:

>  But if you applied the corrections directly to the clock hardware, then
>  anything using the hardware clock would incorporate those corrections,
>  including TCP/IP clocks ... right?

	I don't think so.  The TCP stack on most OSes seems to maintain a 
totally separate clock that is not influenced by the system clock, 
the hardware clock, or anything else outside of the TCP stack.  This 
is the disconnect that I believe needs to be corrected.

Brad Knowles, <brad at stop.mail-abuse.org>

"Those who would give up essential Liberty, to purchase a little
temporary Safety, deserve neither Liberty nor Safety."

     -- Benjamin Franklin (1706-1790), reply of the Pennsylvania
     Assembly to the Governor, November 11, 1755

   SAGE member since 1995.  See <http://www.sage.org/> for more info.

More information about the questions mailing list