On 25 Jul 2015, at 17:49, Patrick Schleizer <patrick-mailingli...@whonix.org> wrote: > On the other hand, I've read the claim "The kernel embeds the system > time in microseconds in TCP connections.", but I haven't found the code > in question to confirm, that this is so. Any idea?
The code is here: http://lxr.free-electrons.com/source/net/core/secure_seq.c In particular the seq_scale(u32 seq) function introduces the timestamp. So if you see two initial sequence numbers for TCP streams between the same source/destination port/IP then you can work out the time difference (in units of 64 ns) according to the clock of the other end point. Best wishes, Steven _______________________________________________ Tails-dev mailing list Tails-dev@boum.org https://mailman.boum.org/listinfo/tails-dev To unsubscribe from this list, send an empty email to tails-dev-unsubscr...@boum.org.
