Nmap Development: Re: Uptime estimates and TCP timestamp offsets

["Michael Pattrick" <mpattrick () rhinovirus org>]

On Mon, Aug 18, 2008 at 10:27 PM, David Fifield <david () bamsoftware com> wrote:
> On Mon, Aug 18, 2008 at 09:36:25PM -0400, Michael Pattrick wrote:
> > On Mon, Aug 18, 2008 at 8:02 PM, David Fifield <david () bamsoftware com> wrote:
> > -snip-
> > > I scanned a Mac OS X 10.5.4 machine moments after booting it up. I
> > > repeated the experiment four times, rebooting each time. I got
> > >
> > >        Ignoring claimed uptime of 1219 days
> > >        Ignoring claimed uptime of 1181 days
> > >        Uptime: 644.073 days
> > >        Ignoring claimed uptime of 871 days
> > With the Debian Lenny kernel, I get:
> > Uptime: 198.840 days (since Sat Feb 02 00:01:06 2008)
> > Uptime: 199.637 days (since Fri Feb 01 04:55:34 2008)
> > Uptime: 199.637 days (since Fri Feb 01 04:57:27 2008)
> > Uptime: 198.838 days (since Sat Feb 02 00:10:15 2008)
> Does it change to a different value after you reboot?
Sorry, I should have clarified, I took all of those directly after I
rebooted; so those represent four different boots, they should all be
close to zero.

Which is kind of odd, because it appears to be adding a random number
that only varies slightly, I guess this requires more investigation.

Cheers,
Michael

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org