[Dshield] Time stamp accuracy

Johannes B. Ullrich jullrich at euclidian.com
Thu Oct 7 01:17:50 GMT 2004

> Johannes, I (loosely) administer my "reporting" network remotely (the
> box sending the reports is inside the network, but most of the time I'm
> outside the network). Is this something participants are urged to do, or
> simply something that would be nice? I can't see myself successfully
> running your script from outside the network sending the reports.

Right now, I am just interested to find out how good/bad the timestamps
are. Some evidence (e.g. from ramp up curves collected during slammer)
show the time stamps are quite good. But in particular for fightback,
I want to know in more detail how good the timestamps are.

I am currently considering that reports with a recently validated
timestamp will be marked as such for fightback.

> Unfortunately, Netopia did not provide for automatic time sync in their
> routers, nor do they allow time to be set to the second, so time is
> likely to be an issue for me all of the time (I make adjustments as
> needed whenever I get inside the network, but that isn't very
> frequently).

doesn't sound like a very good router/fw :-/. 

Johannes Ullrich                     jullrich at euclidian.com
contact: http://johannes.homepc.org/contact.htm

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://www.dshield.org/pipermail/list/attachments/20041006/fd861618/attachment.bin

More information about the list mailing list