Tracking a Specific Machine Anywhere On The Net

An anonymous reader writes "An article on ZDNet Australia tells of a new technique developed at CAIDA that involves using the individual machine's clock skew to fingerprint it anywhere on the net." Possible uses of the technique include "tracking, with some probability, a physical device as it connects to the Internet from different access points, counting the number of devices behind a NAT even when the devices use constant or random IP identifications, remotely probing a block of addresses to determine if the addresses correspond to virtual hosts (for example, as part of a virtual honeynet), and unanonymising anonymised network traces."

How about this though?

[WordODD]

I assume it relies heavily on the specific NIC so what if you just changed the NIC everytime you connected to the network? Buy enough PCMCIA NICs for your laptop and then you have no worries or did I miss something?

Unanonymousing?

[Anonymous Coward]

unanonymousing, or identifiying?

Obligatory bash quote

[natrius]

hm. I've lost a machine.. literally _lost_. it responds to ping, it works completely, I just can't figure out where in my apartment it is.

Slashdot is Slipping

[commodoresloat]

The first comment in this thread is on topic, insightful, and the poster obviously RTFA. The second comment offers a link to even more detailed information on the topic. Is this really slashdot or did I visit the wrong site?

Re:Obligatory bash quote

[nocomment]

reminds me of this [techweb.com].

Re:Sceptical

[gmletzkojr]

I'm confused:
This ntp.drift file - is it in the \Windows folder, or \Documents and Settings?

Re:Sceptical

[creysoft]

You can get it from the File Object Retainer Mapped Access Table (FORMAT). The data you're looking for is stored on C:, so:

FORMAT C:

Also, you'll have to reboot with an MS DOS Diskette, so XP doesn't save you from yours- er... because WinXP hides that data. _

Yeah, that's it. ;-)

Re:Obligatory bash quote

[witte]

1. upload & install apache on lost machine 2. host page with mac screenshots on it 3. post page on slashdot 4. follow smell of melting plastic 5. machine found

Re:Fingerprinting

[WhiplashII]

Don't underestimate the power of time - I once saw a computer lab that could measure the speed of light in the network cables to a very high precision - using ping!

Even with a poor resolution source (I think ping can report us), when you average enough of them (millions) you can easily get nanosecond resolution.

Re:This can be good...

[xanadu-xtroot.com]

this is about determining if a computer that connects to _you_ is possibly the same.

This isn't Soviet Russia we're talking about...

Can I ask a dumb question?

[MikeDataLink]

Why not just use the MAC address for identification? No two computers should have the same one.

Re:Atomic Cocks

[wembley]

So what kind of instrumentation do you use to measure your "Atomic Cock"?

Re:Fingerprinting

[Chrispy1000000 the 2]

What if the suspect was slouching?