Clock slew vulnerability in FreeBSD?

Ted Mittelstaedt tedm at
Thu Mar 10 22:12:09 PST 2005

Your talking about this:


"The basic idea is that you use TCP timestamps to estimate how fast or
slow the remote clock is running. This doesn't give you enough
information to uniquely identify the remote machine, but it does give you
a way to assess whether two given machines are the same. Possible uses
include determining when two machines that have the same address are in
fact different machines (e.g., they're behind a NAT) or whether two
machines with different IP address are actually the same machine (e.g., a

Anthony, I think your a bit mistaken in your description.  This does not
appear to be
much of a security hole.  NAT's are defacto these days on the Internet
and any cracker
is going to assume that there's a good chance he's attacking a NAT.


> -----Original Message-----
> From: owner-freebsd-questions at
> [mailto:owner-freebsd-questions at]On Behalf Of Anthony
> Atkielski
> Sent: Thursday, March 10, 2005 6:46 PM
> To: freebsd-questions at
> Subject: Clock slew vulnerability in FreeBSD?
> How vulnerable is FreeBSD to the recently announced technique for
> individually identifying computers by the clock slew apparent in TCP
> packets?  If it is vulnerable to this, will there be any plans to
> address the vulnerability?
> --
> Anthony
> _______________________________________________
> freebsd-questions at mailing list
> To unsubscribe, send any mail to
> "freebsd-questions-unsubscribe at"

More information about the freebsd-questions mailing list