Clock Skew

["Hans Nilsson" <hasse_gg () ftml net>]

Any thought about implementing the measuring of clock skew in Nmap?
Basically you can detect if two hosts are the same and alot of
interesting things from this value. For example, are these two hosts
just the same firewall spoofing me or not, does this IP have several
boxes behind it, how many computers are behind a NAT etc. Could possibly
be used for OS-detection too. Very interesting stuff if you ask me.

http://www.zdnet.com.au/news/security/soa/Tracking_PCs_anywhere_on_the_Net/0,130061744,139183346,00.htm
http://www.caida.org/publications/papers/2005/fingerprinting/KohnoBroidoClaffy05-devicefingerprinting.pdf
http://www.cl.cam.ac.uk/~sjm217/papers/ccs06hotornot.pdf
-- 
  Hans Nilsson
  hasse_gg () ftml net

-- 
http://www.fastmail.fm - A no graphics, no pop-ups email service


_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org