ICMP Timestamp Type 13/14: Linux Kernel Internals with ftrace
ICMP Timestamp is implemented in every Linux kernel but rarely scrutinized at source level. A depth-8 ftrace investigation of icmp_timestamp() reveals six concrete behaviors that diverge from RFC 792 — including a silent payload threshold, a Code field the kernel never reads, and unconditional ts_ori echo across the full 32-bit range.
