Timestamp
ICMP Type 13 Timestamp is a request for a timestamp from a remote host, used to measure one-way delay and clock offset between hosts. The sender includes its originate timestamp and the receiver fills in receive and transmit timestamps in the Timestamp Reply (Type 14). Rarely used in practice.
Description
ICMP Timestamp messages allow hosts to measure one-way delay and estimate clock differences between systems. The originating host sends Type 13 with its current time in milliseconds since midnight UTC. The receiving host fills in the time it received the message and the time it sent the reply, returning these in ICMP Type 14 (Timestamp Reply).
With all three timestamps available, the sender can compute an estimate of the clock offset and one-way propagation delay. However, ICMP timestamps have millisecond granularity and are affected by queuing and processing delays, making them less accurate than NTP for clock synchronization.
Most modern firewalls block ICMP Timestamp requests (Types 13 and 14) because they can be used for OS fingerprinting and to detect whether a system is online without triggering IDS rules that monitor Echo Requests.
Common Causes
- –Network diagnostic tool measuring one-way delay between hosts
- –Clock offset estimation between hosts without NTP
- –OS fingerprinting tools using timestamp response patterns