Classification of network hosts into groups of similar hosts allows an attacker to transfer knowledge gathered from one host of a group to others. In this paper we demonstrate that it is possible to classify hosts by inspecting the distributions of the response times from ICMP echo requests. In particular, it is shown that the response time of a host is like a fingerprint covering components inside the network, the host software as well as some hardware aspects of the target.
This allows to identify nodes consisting of similar hardware and OS. Instances of virtual machines hosted on a single physical hardware can be detected in the same way. To understand the influence of hardware and software components a simple model is built and the quantitative contribution of each component to the round-trip time is briefly evaluated.
Several experiments show the successful application of the classifier inside an Ethernet LAN and over the Internet.

@techreport{CONCBODOIR10,
	author	 = {Julian Kunkel and Jan C. Neddermeyer and Thomas Ludwig},
	title	 = {{Classification of Network Computers Based on Distribution of ICMP-echo Round-trip Times}},
	year	 = {2010},
	month	 = {09},
	publisher	 = {Staats- und Universitätsbibliothek Hamburg},
	address	 = {Carl von Ossietzky, Von-Melle-Park 3, 20146 Hamburg},
	series	 = {Research Papers},
	number	 = {1},
	abstract	 = {Classification of network hosts into groups of similar hosts allows an attacker to transfer knowledge gathered from one host of a group to others.
In this paper we demonstrate that it is possible to classify hosts by inspecting the distributions of the response times from ICMP echo requests. In particular, it is shown that the response time of a host is like a fingerprint covering components inside the network, the host software as well as some hardware aspects of the target.

This allows to identify nodes consisting of similar hardware and OS. Instances of virtual machines hosted on a single physical hardware can be detected in the same way. To understand the influence of hardware and software components a simple model is built and the quantitative contribution of each component to the round-trip time is briefly evaluated.

Several experiments show the successful application of the classifier inside an Ethernet LAN and over the Internet.},
	url	 = {http://epub.sub.uni-hamburg.de/informatik/volltexte/2010/152/pdf/Classification_of_Network_Computers_Based_on_Distributions_of_ICMP_Echo_Round_Trip_Times.pdf},
}