RE: Clock Skew

["Martin O'Neal" <martin.oneal () corsaire com>]

Hiya,

A couple of years ago, we released a NASL script under GPL for picking
up unsynchronised clocks over HTTP, timestamp and NTP
(http://mail.nessus.org/pipermail/plugins-writers/2004-September/msg0004
5.html).  

Should make a reasonable template for algorithms etc.

Regards,
Martin O'Neal


-----Original Message-----
From: nmap-dev-bounces () insecure org
[mailto:nmap-dev-bounces () insecure org] On Behalf Of Hans Nilsson
Sent: 02 November 2006 06:53
To: nmap-dev () insecure org
Subject: Clock Skew

Any thought about implementing the measuring of clock skew in Nmap?
Basically you can detect if two hosts are the same and alot of
interesting things from this value. For example, are these two hosts
just the same firewall spoofing me or not, does this IP have several
boxes behind it, how many computers are behind a NAT etc. Could possibly
be used for OS-detection too. Very interesting stuff if you ask me.

http://www.zdnet.com.au/news/security/soa/Tracking_PCs_anywhere_on_the_N
et/0,130061744,139183346,00.htm
http://www.caida.org/publications/papers/2005/fingerprinting/KohnoBroido
Claffy05-devicefingerprinting.pdf
http://www.cl.cam.ac.uk/~sjm217/papers/ccs06hotornot.pdf
-- 
  Hans Nilsson
  hasse_gg () ftml net

-- 
http://www.fastmail.fm - A no graphics, no pop-ups email service


_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org