Get remote system time from ICMP timestamp
Read about the protocol and you will find this to be in the format of milliseconds since UT. https://www.ietf.org/rfc/rfc0792.txt
Except for when the device can't provide this and the time is bogus - read the RFC. Clever trick but this will not be a reliable way to get time.
Related videos on Youtube
akgren_soar
Updated on September 18, 2022Comments
-
akgren_soar over 1 year
I read from an article that ICMP Timestamp can be used to determine system time so I tried
hping3 192.168.1.x --icmp --icmp-ts -V
. The output showslen=46 ip=192.168.1.x ttl=xx id=xxxx tos=0 iplen=40 icmp_seq=x rtt=x.xms ICMP timestamp: Originate=27494134 Receive=27316024 Transmit=27316024 ICMP timestamp RTT tsrtt=xx
The problem is that I can't seem to make sense of the output...how do I derive the system time from the above results? Or am I doing something wrong here?
Solution
The timestamp of the remote host can be calculate from
Transmit=27316024
- Converting 27316024 milliseconds to hours, you get 7.59 hours
- 7.59 hours translates to 07:35 Universal Time
- Change the time according to your local time zone
Extras
Timestamp is the number of milliseconds since midnight, universal time.
Originate
is the time that your local machine crafts the request packet
Receive
is the time that the remote machine receives the packet
Transmit
is the time that the remote machine crafts the response packet-
Admin over 7 yearstry nmap for detecting remote systems
-
Admin over 7 years@IporSircer I have tried
nmap -sn -A -vvv 192.168.1.x
. However, this only tells me that the host is up, it does not tell the current system time on that remote host.