Re: Tracking Clock Skew; Computer Forensics

Matthew Toseland <toad-EI5O+8PHWbJeeLb3ft/[email protected]> writes:

>> I thought about that.  But wouldn't you still have a consistent,
>> detectable skew, at least most of the time? 
>
> You think so? Caused by what?

If you don't synchronize often enough.  From page 10 of the paper in
question:

---
"As the horizontal line in Table 3 indicates, we divide our
experiments into two sets. In the first set, our experiments last for
three hours and exchange one TCP packet every minute (we do this by
performing a sleep(60) on host1). For the second set of experiments,
the connections last for 30 minutes, and a packet is exchanged at
random intervals between 0 and 2 seconds, as determined by a usleep on
host1. With few exceptions, the packets from laptop are all ACKs with
no data."
---

The clock skew estimates are roughly the same.  And I always found
that synching one time a day would be enough, well...

bye, Adam.

_______________________________________________
chat mailing list
[email protected]
Archived: http://news.gmane.org/gmane.network.freenet.general
Unsubscribe at http://dodo.freenetproject.org/cgi-bin/mailman/listinfo/chat
Or mailto:[email protected]?subject=unsubscribe