ICMP Timestamp Request Remote Date Disclosure This host returns non-standard timestamps (high bit is set) The ICMP timestamps might be in little endian format (not in network format) The remote clock is synchronized with the local clock. How to reso

Question

ICMP Timestamp Request Remote Date Disclosure This host returns non-standard timestamps (high bit is set) The ICMP timestamps might be in little endian format (not in network format) The remote clock is synchronized with the local clock. How to reso

Jay Tee 30

ICMP Timestamp Request Remote Date Disclosure

This host returns non-standard timestamps (high bit is set)

The ICMP timestamps might be in little endian format (not in network format)

The remote clock is synchronized with the local clock.

How to resolve this or do we have any information if we can restrict on firewall?

1 answer

Your answer

Answer 1

Hi Jay Tee,

Your host’s little-endian timestamp replies leak its system clock. You can eliminate this exposure either at the OS level or in your firewall/router. Below is a structured approach.

Windows Server • Disable timestamp replies in the registry:

Run regedit.

Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters.

Create DWORD DisableICMPRedirect = 1.

Reboot or restart the TCP/IP stack. • Alternatively, use Windows Firewall: # Block inbound timestamp requests (ICMP type 13) New-NetFirewallRule -DisplayName "Block ICMP Timestamp Req" -Protocol ICMPv4 -IcmpType 13 -Direction Inbound -Action Block # Block outbound timestamp replies (ICMP type 14) New-NetFirewallRule -DisplayName "Block ICMP Timestamp Rep" -Protocol ICMPv4 -IcmpType 14 -Direction Outbound -Action Block

Now test using hping3 or nping to probe type 13:
hping3 --icmp --icmp-ts <target_ip>

If could, please tell me what kind of firewall you are using so I can specify more on the steps to deal with it

================================================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Jay Tee 30 Reputation points

2025-08-11T11:40:39.28+00:00

Where do i run this, CMD?
hping3 --icmp --icmp-ts <target_ip>
Oliver Nguyen 410 Reputation points Independent Advisor

2025-08-11T12:17:15.71+00:00

Run based on Linux. Or you can use Nmap (incl. nping):

Download and install Nmap for Windows (it bundles nping).

Open cmd.exe and run one of these:

Send only timestamp requests nmap -sn -PP 192.168.1.1 -sn tells Nmap to skip port scans, and -PP issues ICMP timestamp pings.

Using nping directly nping --icmp --icmp-type timestamp-request 192.168.1.1

Either command will show you if the target replies with an ICMP type 14 timestamp response.

Share via

ICMP Timestamp Request Remote Date Disclosure This host returns non-standard timestamps (high bit is set) The ICMP timestamps might be in little endian format (not in network format) The remote clock is synchronized with the local clock. How to reso

1 answer

Your answer