[ntp:questions] Re: Fingerprinting hosts by clock skew

Mxsmanic mxsmanic at hotmail.com
Thu Mar 10 16:57:38 UTC 2005


Brad Knowles writes:

> I don't think so.  The TCP stack on most OSes seems to maintain a 
> totally separate clock that is not influenced by the system clock, 
> the hardware clock, or anything else outside of the TCP stack.  This 
> is the disconnect that I believe needs to be corrected.

It must reference some sort of clock keeping real time, if it is
supposed to be linked to actual elapsed time.  If not, it's a complete
simulation, and I'm not even sure what purpose it serves in that case
(?).

In any case, UNIX does not include this information, anyway, right?  (Or
is it Windows that doesn't include it?)

-- 
Transpose hotmail and mxsmanic in my e-mail address to reach me directly.



More information about the questions mailing list