[Current] Re: DShield Timestamp
Johannes B. Ullrich
jullrich at euclidian.com
Thu Oct 7 20:48:12 UTC 2004
the time zone should be expressed as '-04:00' , not '-04' . I assume
that my parser got confused. Good catch. I will try to make the parser
more forgiving in this case.
(the minute part is somewhat important, as there are a few :30 time
On Thu, 2004-10-07 at 15:43, Jonathan C. Webster wrote:
> There clearly is a problem here, but it's hard to see that it is mine. Anybody have any ideas??
> The firewall log line as I submitted it was (with my dshield ID and IP obfuscated):
> 2004-10-07 12:27:19 -04 xxxxxx 1 188.8.131.52 59814 aaa.bbb.ccc.ddd 10060 TCP
> the date part in hex
> 00004890: 3539 3509 5443 500a 3230 3034 2d31 302d 595.TCP.2004-10-
> 000048a0: 3037 2031 323a 3237 3a31 3920 2d30 3409 07 12:27:19 -04.
> Should I use 0d0a line end?
> My firewall reports in EDT. See your interpretation of that line below.
> DShield TimeStamp wrote:
> > You visited the DShield server's timestamp page. We compared the
> > logs you submitted with our records and found the following times:
> > Our Time: 2004-10-07 16:27:16 UTC
> > Your Time: 2004-10-06 16:23:19 UTC
> > If the difference between these two times is larger than 1 minute,
> > we ask you to try and adjust your time more frequently.
> > Thank you very much for participating in DShield!
> > please reply to this e-mail if you have any further questions.
Johannes Ullrich jullrich at euclidian.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://www.dshield.org/pipermail/current/attachments/20041007/ada16b06/attachment.bin
More information about the Current