
teChnology 91
implementations set the value. When the scanner sees such value sent
when the time-stamp option was never used, the choice in operating
systems is narrowed considerably.
Another phenomenon to measure is the incrementing of the time
stamp. By first determining the RTT between the scanner and the
target, you then know how much time should elapse between TCP
segments. e remote OS will increment the time stamp on each seg-
ment by a certain value. e way in which the target increments the
value can reveal the type of OS.
For example, we know that OS XYZ increments the time stamp by
one for every 500 ms of uptime. e average RTT bet ...