----- Original Message -----
From: "Martin Mačok" <martin.macok@underground.cz>
To: <firewalls@securityfocus.com>
Sent: Wednesday, September 15, 2004 5:29 AM
Subject: ICMP timestamps (Re: Wierd ICMP in logs)
http://www.networkmagazine.com/article/NMG20000829S0003
"Getting a response to a Timestamp Request not only tells you that
a system is up but also that it is not running a Microsoft
operating system."
This is not true. I have several Windows systems around me within our
company and they all answers to ICMP Timestamp Request. Actually, you
can differentiate some stacks when you inspect the timestamp replies.
See ICMPinfo.c from http://aluigi.altervista.org/mytoolz.htm
Martin Mačok
IT Security Consultant
Hi Martin,
I can't comment on why the author wrote that. He cites a paper by Ofir
Arkin as a resource for his article. I had a closer look at it.
http://www.sys-security.com/html/projects/icmp.html
According to ICMP Usage in Scanning V.3, Mr.Arkin states on page 43:
"Most of the operating systems have implemented the ICMP Timestamp
request and reply mechanism. When I have sent an ICMP Timestamp
request to a Windows NT 4 SP6a based machine, I got no reply. Again,
this is not abnormal behavior from the Microsoft Windows NT machine,
just an implementation choice as RFC 1122 states."
In fact, he goes on to provide numerous charts comparing the response of
various OS to Time Stamp requests (as well as other ICMP types under
different conditions). Apparently NT4 and Win95 do not respond while
Win98/ME and Win2k do respond. There's no mention of Win2003 or XP.
So, good call ;) I just hope I am equally astute in my interpretation
of the OPs fw logs.
Cheers,
Gary
