[Dshield] Time stamp accuracy
Johannes B. Ullrich
jullrich at euclidian.com
Thu Oct 7 01:17:50 GMT 2004
> Johannes, I (loosely) administer my "reporting" network remotely (the
> box sending the reports is inside the network, but most of the time I'm
> outside the network). Is this something participants are urged to do, or
> simply something that would be nice? I can't see myself successfully
> running your script from outside the network sending the reports.
Right now, I am just interested to find out how good/bad the timestamps
are. Some evidence (e.g. from ramp up curves collected during slammer)
show the time stamps are quite good. But in particular for fightback,
I want to know in more detail how good the timestamps are.
I am currently considering that reports with a recently validated
timestamp will be marked as such for fightback.
> Unfortunately, Netopia did not provide for automatic time sync in their
> routers, nor do they allow time to be set to the second, so time is
> likely to be an issue for me all of the time (I make adjustments as
> needed whenever I get inside the network, but that isn't very
doesn't sound like a very good router/fw :-/.
Johannes Ullrich jullrich at euclidian.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://www.dshield.org/pipermail/list/attachments/20041006/fd861618/attachment.bin
More information about the list