Previous work on a subset of the internet has identified a number of unique behaviors in ICMP timestamp responses. In this study we expand to studying the entire routable IPv4 address space, surveying ICMP timestamp responsiveness and the prevalence of specific response behaviors. We introduce a new behavior called "uptime" to the existing behavioral classification taxonomy. Additionally, we combine banner-grabbing scan data with our ICMP response classifications to evaluate the utility of ICMP timestamp behaviors in device fingerprinting.

Approved for public release; distribution is unlimited.

http://archive.org/details/sunupicmptimesta1094563471

Outstanding Thesis

Civilian