Uninformed: Informative Information for the Uninformed

Vol 2» 2005.Sept


ICMP Timestamps

The ICMP TIMESTAMP request (13) can be used to obtain a machine's measurement of the number of milliseconds that have occurred since midnight UT. If an attacker can infer or assume that a target machine's system time is set to a specific date and timezone, it may be possible to calculate the absolute system time down to a millisecond resolution. This would satisfy the timing requirements and make it possible to make use of temporal addresses that have a scale that is measured from an absolute time. According to the RFC, though, if a system is unable to determine the number of milliseconds since UT then it can use another value capable of representing time (though it must set a high-order bit to indicate the non-standard value).