topic Re: TCP timestamp response During the vulnerability assessment in General Topics

TCP timestamp response During the vulnerability assessment

Mohammed_Yasin — Wed, 10 Feb 2021 06:37:38 GMT

In my case, the team is performing a vulnerability assessment on PA820

Vulnerability Title: TCP timestamp response.

Description: The remote host responded with a TCP timestamp. The TCP timestamp response can be used to approximate the remote host's uptime, potentially aiding in further attacks. Additionally, some operating systems can be fingerprinted based on the behavior of their TCP timestamps.

The scanning was running to the MGMT IP,

How to disable the timestamp response.

Re: TCP timestamp response During the vulnerability assessment

kiwi — Wed, 10 Feb 2021 10:14:04 GMT

Hi @Mohammed_Yasin ,

I'm pretty sure you won't be able to do this unless you root into the device and edit some config-file.

I'd recommend reaching out to support with your findings of the vulnerability assessment.

Cheers,

-Kiwi.

Re: TCP timestamp response During the vulnerability assessment

DaBone — Fri, 07 May 2021 19:39:10 GMT

The answer to this is found here:
https://live.paloaltonetworks.com/t5/threat-vulnerability-discussions/tcp-timestamp-response-on-mgmnt-ip/td-p/384943

User @mivaldi explains this topic and what can be done.

Also found this option as well:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFZCA0