Timestamp Reply
ICMP Type 14 Timestamp Reply is sent in response to a Timestamp Request (Type 13). It carries three 32-bit millisecond timestamps: the originator's send time (echoed from the request), the time the reply was received, and the time the reply was transmitted. Together these enable one-way delay computation.
Description
ICMP Timestamp Reply is the response half of the ICMP timestamp mechanism. The replying host populates the Receive Timestamp (time the request was received) and Transmit Timestamp (time the reply was sent) while echoing the Originate Timestamp from the request.
The sender can then compute: one-way delay = ((Receive – Originate) + (Reply-received – Transmit)) / 2 under the assumption of symmetric delays. Clock offset can be estimated as: offset = ((Receive – Originate) – (Reply-received – Transmit)) / 2.
Timestamp replies are blocked by most production firewalls alongside Type 13 requests. The combination is considered a reconnaissance vector allowing attackers to determine system uptime and fingerprint OS implementations from timestamp frequency patterns.
Common Causes
- –Response to ICMP Timestamp Request (Type 13)
- –Network latency measurement tool receiving its probe response