Tinker Tailor Soldier Spy - How to detect a router in your network

Imagine you are an administrator of the network shown on the diagram. All you have is an access to router R1. You suspect that user U1 is not just a computer, but the router with configured NAT. This means unauthorized devices in your network. How would you prove and fight it?

In this post I will describe you the technique based on TCP timestamps and how with the help of those you could detect NAT in your network.

About TCP timestamps

TCP timestamps option consist of two 4-bytes fields:

• The timestamp Value field (TSval) contains the current value of the timestamp clock of the TCP sending the option.
• Timestamp Echo Reply (TSecr) - this field is only valid if the ACK bit is set in the TCP header. If it is valid, it echos a timestamp value that was sent by the remote TCP in the TSval field of a Timestamps option.

TSval is the one we will work with. Each OS implementation increment this value at a specific rate. So it is possible to infer the system uptime from the timestamp option if the targeted OS is known.

For Linux timer rate is defined during kernel compilation and usually equals 250. So if you see smth like this in tcpdump:

09:29:18.663124 IP 192.168.0.12.54793 > 8.8.8.8.53: Flags [S], seq 3386060712, win 29200, options [mss 1460,sackOK,TS val 3659526 ecr 0,nop,wscale 7], length 0

I know that 192.168.0.12 is a linux machine, so its uptime would be approximately: 3659526/250/60/60 ~ 4 hours

Another good and important thing about TSval - it is usually not changed by Network Address Translation.

Theory

By monitoring the traffic on R1 you should:

• Create a list of timestamps received from U1
• Based on the idea that two hosts behind a NAT have a distinctive timestamp because they can’t have the same uptime, unless they have been booted within the same millisecond, distinguish two or more hosts.

First steps and visual contact

I ran tcpdump with the following flags to collect the timestamps (192.168.0.12 is my router):

tcpdump -c 100000 -w nat.timestamp.dump -i eth0 src host 192.168.0.12 and tcp

Then with a simple python script and scapy I've created the list which looks like this:

1434112464.25 9135849
1434112464.44 101360108
1434112464.44 101360108
1434112464.44 101360111
...

The value on the left is a timestamp of the capture, the value of the right is TSval of the captured packet. Here is how graph looks (date on X-axis, TSval on Y-axis):

You can see that there are two distinctive TSvals, which means that there are at least two different hosts behind this router. Cool, right?

Catch the spy

Automatic detection is quite tricky in our situation. And that is why:

• As we already know various operating systems calculate TSval differently.
• User might modify TSvals on the router.

We can't fight with the second option, but with the first we still have some chances. Timestamps can be represented as a linear function:

TSval = IncBySec * sec + In

IncBySec differs in different operating systems. In - is an initial timestamp value. In all OSes it equals zero, whereas in Windows it is random (that is why it is not possible to calculate an uptime of a Windows host based on TSval). 

We need a technique to overcome operating systems limitations. For instance, we could do the following:

A = TSval_1 - TSval_2 / S1 - S2

Where TSval_1 and TSval_2 are the timestamps gathered at time S1 and S2. 

Now, all we need is to find how many increments do we have. The amount of increments will give us the amount of hosts.