Remote Host Fingerprinting based on Clock Skew

Abstract

This paper studies some properties of clock skews as means of remote hosts fingerprinting. There are several attempts for fingerprinting device from the captured packets so far, e. g., TCP timestamp, IP timestamp, and NTP. Our contribution is the experimental results in terms of the ICMP timestamps, which allow us to identify the upper bound for the number of distinguishable hosts with respects to a period of time. Based on the experiment, we clarify that the clock skew are uniformly distributed depending on machines, and the fluctuation in clock skews for any single hosts is negligibly small in comparison of the variance of clock skews for distinct hosts. In addition, we show that the upper bound of number of unique hosts can be improved by increasing the duration for observation under an assumption of normal distribution of clock skews and the birthday paradox.