Re: [Tails-dev] [tor-talk] Can TCP Sequence Numbers leak Sys…

This message is part of the following thread:
M\the complete thread tree sorted by date
MMaka at <-
 
Delete this message

Reply to this message
Author: Murdoch, Steven
Date:  
To: tor-talk@lists.torproject.org, Patrick Schleizer
CC: The Tails public development discussion list, Whonix-devel
Subject: Re: [Tails-dev] [tor-talk] Can TCP Sequence Numbers leak System Clock?
On 25 Jul 2015, at 17:49, Patrick Schleizer <patrick-mailinglists@???> wrote:
> On the other hand, I've read the claim "The kernel embeds the system
> time in microseconds in TCP connections.", but I haven't found the code
> in question to confirm, that this is so. Any idea?

The code is here:
http://lxr.free-electrons.com/source/net/core/secure_seq.c

In particular the seq_scale(u32 seq) function introduces the timestamp.

So if you see two initial sequence numbers for TCP streams between the same source/destination port/IP then you can work out the time difference (in units of 64 ns) according to the clock of the other end point.

Best wishes,
Steven




This message was posted to the following mailing lists:
tails-dev
Mailing List Info | Nearby Messages		<-Re: [Tails-dev] Please update the status of your 1.5 ticketsRe: [Tails-dev] TAILS build system with Vagrant 1.7.3->
lists.autistici.org administrated by postmasterLurker (version 2.3)