CAPEC-320

TCP Timestamp Probe

Low severityMedium likelihoodDetailed pattern

This OS fingerprinting probe examines the remote server's implementation of TCP timestamps. Not all operating systems implement timestamps within the TCP header, but when timestamps are used then this provides the attacker with a means to guess the operating system of the target. The attacker begins by probing any active TCP service in order to get response which contains a TCP timestamp. Different Operating systems update the timestamp value using different intervals. This type of analysis is most accurate when multiple timestamp responses are received and then analyzed. TCP timestamps can be found in the TCP Options field of the TCP header.

On this page

Ask an AI about this attack pattern
How the attack unfolds
Prerequisites
Resources required
Consequences
Weaknesses it exploits
Related attack patterns

Ask an AI about this attack pattern

ChatGPT Claude Google AI Mode

Show the prompt

Explain the attack pattern CAPEC-320: TCP Timestamp Probe: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/320.html and https://cve.bz/cve/capec/320?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.

How the attack unfolds

Explore
The attacker looks for a way in.
1. [Determine if timestamps are present.] The adversary sends a probe packet to the remote host to identify if timestamps are present.
Experiment
They probe what they found.
1. [Record and analyze timestamp values.] If the remote host is using timestamp, obtain several timestamps, analyze them and compare them to known values.
  3 techniques
  - The adversary sends several requests and records the timestamp values.
  - The adversary analyzes the timestamp values and determines an average increments per second in the timestamps for the target.
  - The adversary compares this result to a database of known TCP timestamp increments for a possible match.

Prerequisites

The ability to monitor and interact with network communications.Access to at least one host, and the privileges to interface with the network interface card.The target OS must support the TCP timestamp option in order to obtain a fingerprint.

Resources required

Any type of active probing that involves non-standard packet headers requires the use of raw sockets, which is not available on particular operating systems (Microsoft Windows XP SP 2, for example). Raw socket manipulation on Unix/Linux requires root privileges.
A tool capable of sending and receiving packets from a remote system.

Consequences

What a successful attack can lead to
Impact	Affects	Note
Read Data	Confidentiality
Bypass Protection Mechanism	Confidentiality, Access Control, Authorization

Weaknesses it exploits

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Recent CVEs with these weaknesses

4.3CVE-2026-1249442026-11-10
Information disclosure in the Marionette component. This vulnerability was fixed in Firefox 160.
4.3CVE-2026-1249412026-11-10
Information disclosure in the Security: RLBox component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.
4.3CVE-2026-1249302026-11-10
Information disclosure in the Address Bar component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.
4.3CVE-2026-1249292026-11-10
Information disclosure in the Layout: Form Controls component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.
4.3CVE-2026-1249252026-11-10
Information disclosure in the Layout component. This vulnerability was fixed in Firefox 160.
4.3CVE-2026-1249092026-11-10
Information disclosure in the Private Browsing component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.
5.3CVE-2026-967692026-11-10
The Extend B2B - Companies and Users Management for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via the register_company_api. This makes it possible for unaut…
7.5CVE-2026-636442026-11-09
bird-lg-go is a BIRD looking glass in Go. Prior to version 1.4.7, unsanitized input path enables arbitrary local file read, allowing an unauthenticated remote attacker to read sensitive files such as /etc/shadow and /root/.bash_history. Th…

The newest records naming one of them. Each weakness's page lists them all.

Part of: CAPEC-312 Active OS Fingerprinting

MITRE's words, unchanged: CAPEC-320 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.