Subject: Re: [tcpm] tcpm timestamp

From: Jamal Cynthia <[email-masked]>
Date: Mon, 16 Jul 2012 08:41:49 -0700 (PDT)

TCP timestamps are used to provide protection against wrapped sequence numbers. It is possible to calculate system uptime (and boot time) by analyzing TCP timestamps.These calculated uptimes (and boot times) can help in detecting hidden network-enabled operating systems,linking spoofed IP and MAC addresses together,linking IP addresses with Ad-Hoc wireless APs, etc.The TCP time-stamp option provides better TCP round-trip time measurements. Because the time stamps are always sent and echoed in both directions and the time-stamp value in the header is always changing, TCP header compression will not compress the outgoing packet. To allow TCP header compression over a serial link, the TCP time-stamp option is disabled.TCP timestamps help TCP determine in which order packets were sent. TCP timestamps are not normally aligned to the system clock and start at some random value. Many operating systems will increment the timestamp for every elapsed milisecond;
 however RFC only states that the tics should be proportional.