Security-Research

icmp_timestamp() is implemented in every Linux kernel but never scrutinized at source level. A depth-8 ftrace investigation reveals six RFC 792 deviations: silent payload length threshold, Code field never validated, ts_ori echoed unconditionally across the full 32-bit range, conntrack state creation on Type 13, netfilter hook ordering, and reply generation path that bypasses standard socket accounting. Full call chain mapped: ip_rcv() → icmp_rcv() → icmp_timestamp() → icmp_reply() with all branching conditions documented.

Linux and Windows ICMP Echo Requests differ in payload size (64B vs 40B), default content (timestamp vs alphabetical), and TTL values — forming OS-specific network fingerprints that NIDS use for traffic classification. Traffic mimicry replicates these signatures at the assembly level: 8-byte RDTSC timestamp emulation, sequential byte padding (0x10–0x1F), and strict 64-byte structural alignment bypass DPI anomaly detection without triggering empty-payload or entropy signatures.

Stateful firewalls and DPI engines classify ICMP Type 3 (Port Unreachable) as error traffic and skip deep inspection. RFC 792 requires the original IP header plus 8 bytes in the reflection field — this is attacker-controlled space. By placing a fully-formed secondary ICMP header inside the reflection segment, arbitrary protocol data traverses perimeter controls unanalyzed. The 0xFFFF boundary anomaly causes packet boundary miscalculation in DPI engines, leaving the nested payload invisible to signature matching. Full x64 Assembly implementation with raw socket crafting.