ICMP timestamp request and response packets have been standardized for nearly 40 years, but have no modern practical application, having been superseded by NTP. However, ICMP timestamps are not deprecated, suggesting that while hosts must support them, little attention is paid to their implementation and use. In this work, we perform active measurements and find 2.2 million hosts on the Internet responding to ICMP timestamp requests from over 42,500 unique autonomous systems. We develop a methodology to classify timestamp responses, and find 13 distinct classes of behavior. Not only do these behaviors enable a new fingerprinting vector, some behaviors leak important information about the host e.g., OS, kernel version, and local timezone.
Buchholz and Tjaden leveraged timestamps in the context of forensic reconstruction and correlation @cite_7 . Similar to our results, they find a wide variety of clock behaviors. However, while they probe @math 8,000 web servers, we perform an Internet-wide survey including 2.2M hosts more than a decade later, and demonstrate novel fingerprinting and geolocation uses of timestamps.
@cite_7
2129680786 2160625863 2083594366 2143229717
In this paper we describe the first large-scale, long-term study of how hosts connected to the Internet manage their clocks. This is important for forensic investigations when there is a need for correlation of events collected from disparate sources, as well as for the correlation of computer events to ''real'' time. We have sampled over 8000 web servers on the Internet on a regular basis for a period of over six months. We have found that only about 74 of the hosts we observed were within 10s of our reference time (UTC). The other hosts exhibited a large variety of different clock behaviors, some of which are explainable by existing clock models, some not, warranting further research in the area of forensic time and clock analysis. Time-based localization approaches attract a lot of interest due to their high accuracy and potentially low cost for wireless sensor networks (WSNs). However, time-based localization is tightly coupled with clock synchronization. Thus, the reliability of timestamps in time-based localization becomes an important yet challenging task to deal with. In this paper, we propose robust time-based localization strategies to locate a target node with the help of anchors (nodes with known positions) in asynchronous networks. Two kinds of asynchronous networks are considered: one only with clock offsets, labeled quasi-synchronous networks, whereas the other with not only clock offsets but also clock skews, labeled fully asynchronous networks. A novel ranging protocol is developed for both networks, namely asymmetric trip ranging (ATR), to reduce the communication load and explore the broadcast property of WSNs. Regardless of the reliability of the timestamp report from the target node, closed-form least-squares (LS) estimators are derived to accurately estimate the target node position. As a result, we counter the uncertainties caused by the target node by ignoring the timestamps from this node. Furthermore, in order to simplify the estimator in fully asynchronous networks, localization and synchronization are decoupled. A simple yet efficient method is proposed to first Calibrate the Clock Skews of the anchors, and then Estimate the Node Position (CCS-ENP). Finally, Cramer-Rao bounds (CRBs) and simulation results corroborate the efficiency of our localization schemes. We study a fingerprinting game in which the number of colluders and the collusion channel are unknown. The encoder embeds fingerprints into a host sequence and provides the decoder with the capability to trace back pirated copies to the colluders. Fingerprinting capacity has recently been derived as the limit value of a sequence of maximin games with mutual information as their payoff functions. However, these games generally do not admit saddle-point solutions and are very hard to solve numerically. Here under the so-called Boneh-Shaw marking assumption, we reformulate the capacity as the value of a single two-person zero-sum game, and show that it is achieved by a saddle-point solution. If the maximal coalition size is k and the fingerprinting alphabet is binary, we show that capacity decays quadratically with k. Furthermore, we prove rigorously that the asymptotic capacity is 1 (k221n2) and we confirm our earlier conjecture that Tardos' choice of the arcsine distribution asymptotically maximizes the mutual information payoff function while the interleaving attack minimizes it. Along with the asymptotics, numerical solutions to the game for small k are also presented. Recent advances in miniaturization and low-cost, low-power design have led to active research in large-scale networks of small, wireless, low-power sensors and actuators. Time synchronization is critical in sensor networks for diverse purposes including sensor data fusion, coordinated actuation, and power-efficient duty cycling. Though the clock accuracy and precision requirements are often stricter than in traditional distributed systems, strict energy constraints limit the resources available to meet these goals.We present Reference-Broadcast Synchronization, a scheme in which nodes send reference beacons to their neighbors using physical-layer broadcasts. A reference broadcast does not contain an explicit timestamp; instead, receivers use its arrival time as a point of reference for comparing their clocks. In this paper, we use measurements from two wireless implementations to show that removing the sender's nondeterminism from the critical path in this way produces high-precision clock agreement (1.85 ± 1.28μsec, using off-the-shelf 802.11 wireless Ethernet), while using minimal energy. We also describe a novel algorithm that uses this same broadcast property to federate clocks across broadcast domains with a slow decay in precision (3.68 ± 2.57μsec after 4 hops). RBS can be used without external references, forming a precise relative timescale, or can maintain microsecond-level synchronization to an external timescale such as UTC. We show a significant improvement over the Network Time Protocol (NTP) under similar conditions.