Re: Strange ICMP timestamp replies

[Florian Weimer <Florian.Weimer () RUS UNI-STUTTGART DE>]

"Nexus" <nexus () patrol i-way co uk> writes:

> The only effective (?) use I know of as regards ICMP timestamps is if you
> are attacking a time seeded or based crypto method by trying to enumerate
> the exact time on the target host.

Hmm, but you wouldn't send ICMP Timestamp Replies to gather such
information, would you?  They are unsuitable for remote OS detection
as well, I think.  I don't think there exists are device which
responds to such messages.

> Might be something completely else as well - some broken/sick net
> device ?

It has to be something like this.

--
Florian Weimer                    Florian.Weimer () RUS Uni-Stuttgart DE
University of Stuttgart           http://cert.uni-stuttgart.de/
RUS-CERT                          +49-711-685-5973/fax +49-711-685-5898