What MITRE CAPEC-320: TCP Timestamp Probe (Detailed Attack Pattern - Low Severity) requires
MITRE CAPEC-320 (TCP Timestamp Probe) is a detailed-level attack pattern in the MITRE Common Attack Pattern Enumeration and Classification. This OS fingerprinting probe examines the remote server's implementation of TCP timestamps. Not all operating systems implement timestamps within the TCP header, but when timestamps are used then this provides the attacker with a means to guess the operating system of the target. The attacker begins by probing any active TCP service in order to get response which contains a TCP timestamp. Likelihood of attack: Medium. Typical severity: Low. Maps to weaknesses CWE-200.
Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated:
Primary source: https://capec.mitre.org/data/definitions/320.html
SHA-256 integrity: f1b1e19607731d3f5a5119b192638d087284ba075162c523265d47346b0632b7
Primary Citations — 7 traced to source
- MITRE CAPEC-320: TCP Timestamp Probe (https://capec.mitre.org/data/definitions/320.html)
- CWE-200: underlying weakness (http://cwe.mitre.org/data/definitions/200.html)
+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
- Discovery (free): /api/v1/nodes/mitre-capec-capec-320-tcp-timestamp-probe.json — 6-field metadata
- Vault (full node): /api/v1/vault/nodes/mitre-capec-capec-320-tcp-timestamp-probe.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
- Canonical URL: https://bidda.com/intelligence/mitre-capec-capec-320-tcp-timestamp-probe
- Back to registry: Browse all 10,085 compliance nodes