ICMP timestamp request and response packets have been standardized for nearly 40 years, but have no modern practical application, having been superseded by NTP. However, ICMP timestamps are not deprecated, suggesting that while hosts must support them, little attention is paid to their implementation and use. In this work, we perform active measurements and find 2.2 million hosts on the Internet responding to ICMP timestamp requests from over 42,500 unique autonomous systems. We develop a methodology to classify timestamp responses, and find 13 distinct classes of behavior. Not only do these behaviors enable a new fingerprinting vector, some behaviors leak important information about the host e.g., OS, kernel version, and local timezone.
Buchholz and Tjaden leveraged timestamps in the context of forensic reconstruction and correlation @cite_7 . Similar to our results, they find a wide variety of clock behaviors. However, while they probe @math 8,000 web servers, we perform an Internet-wide survey including 2.2M hosts more than a decade later, and demonstrate novel fingerprinting and geolocation uses of timestamps.
@cite_7
2129680786
In this paper we describe the first large-scale, long-term study of how hosts connected to the Internet manage their clocks. This is important for forensic investigations when there is a need for correlation of events collected from disparate sources, as well as for the correlation of computer events to ''real'' time. We have sampled over 8000 web servers on the Internet on a regular basis for a period of over six months. We have found that only about 74 of the hosts we observed were within 10s of our reference time (UTC). The other hosts exhibited a large variety of different clock behaviors, some of which are explainable by existing clock models, some not, warranting further research in the area of forensic time and clock analysis.