Informative Information for the Uninformed | ||||||||||||||
|
||||||||||||||
Next: IP Timestamp Option
Up: Determining System Time
Previous: DCERPC SrvSvc NetrRemoteTOD
  Contents
ICMP Timestamps
The ICMP TIMESTAMP request (13) can be used to obtain a
machine's measurement of the number of milliseconds that have
occurred since midnight UT. If an attacker can infer or assume that
a target machine's system time is set to a specific date and
timezone, it may be possible to calculate the absolute system time
down to a millisecond resolution. This would satisfy the timing
requirements and make it possible to make use of temporal addresses
that have a scale that is measured from an absolute time. According
to the RFC, though, if a system is unable to determine the number of
milliseconds since UT then it can use another value capable of
representing time (though it must set a high-order bit to indicate
the non-standard value).
|