1

I read from an article that ICMP Timestamp can be used to determine system time so I tried hping3 192.168.1.x --icmp --icmp-ts -V. The output shows

len=46 ip=192.168.1.x ttl=xx id=xxxx tos=0 iplen=40 icmp_seq=x rtt=x.xms
ICMP timestamp: Originate=27494134 Receive=27316024 Transmit=27316024
ICMP timestamp RTT tsrtt=xx

The problem is that I can't seem to make sense of the output...how do I derive the system time from the above results? Or am I doing something wrong here?

Solution

The timestamp of the remote host can be calculate fromTransmit=27316024

  1. Converting 27316024 milliseconds to hours, you get 7.59 hours
  2. 7.59 hours translates to 07:35 Universal Time
  3. Change the time according to your local time zone

Extras

Timestamp is the number of milliseconds since midnight, universal time.

Originate is the time that your local machine crafts the request packet
Receive is the time that the remote machine receives the packet
Transmit is the time that the remote machine crafts the response packet

akgren_soar
  • 181
  • 2
  • 7
  • try [nmap](https://nmap.org/) for detecting remote systems – Ipor Sircer Dec 01 '16 at 09:04
  • @IporSircer I have tried `nmap -sn -A -vvv 192.168.1.x`. However, this only tells me that the host is up, it does not tell the current system time on that remote host. – akgren_soar Dec 01 '16 at 09:24

1 Answers1

3

Read about the protocol and you will find this to be in the format of milliseconds since UT. https://www.ietf.org/rfc/rfc0792.txt

Except for when the device can't provide this and the time is bogus - read the RFC. Clever trick but this will not be a reliable way to get time.

John Mahowald
  • 32,050
  • 2
  • 19
  • 34