Very Computer

Hi :
I was looking at netcraft.com for amazon.com website statistics ( they
moved to Linux recently ).

http://uptime.netcraft.com/up/graph/?host=www.amazon.com

I noticed that they have a 'time since reboot' graph. I did not know
that this data comes in the HTTP header. ( Does it.? ). So how did
netcraft provide the graph.

Also while looking at their graph, I was expecting the graph to
increment 30 days ( Y axis ) during the period of 1 month ( x axis ),
assuming they did not crash. I m not sure how to interpret this graph.
Though I tries their FAQ, i couldn t get any proper explanation.

Pl share the knowledge if you know the answer.

--sony

Quote:>Hi :
>I was looking at netcraft.com for amazon.com website statistics ( they
>moved to Linux recently ).

>http://uptime.netcraft.com/up/graph/?host=www.amazon.com

>I noticed that they have a 'time since reboot' graph. I did not know
>that this data comes in the HTTP header. ( Does it.? ). So how did
>netcraft provide the graph.

It's not in the header, by examining time stamps in the tcp packets
themselves, you can estimate how long it has been since the machine
was reooted.  nmap can perform this function as well, using the -O
option.

Quote:>Also while looking at their graph, I was expecting the graph to
>increment 30 days ( Y axis ) during the period of 1 month ( x axis ),
>assuming they did not crash. I m not sure how to interpret this graph.

It probably doesn't look like you expect because amazon has more than one
server, and when netcraft checks, they hit different servers at different
times, which give different results...

--
Jason S Kohles                       A witty saying proves nothing.

http://www.jasonkohles.com/

Quote:>>I noticed that they have a 'time since reboot' graph. I did not know
>>that this data comes in the HTTP header. ( Does it.? ). So how did
>>netcraft provide the graph.

>It's not in the header, by examining time stamps in the tcp packets
>themselves, you can estimate how long it has been since the machine
>was reooted.  nmap can perform this function as well, using the -O
>option.

Do you happen to know by which method they extrapolate the OS in use?

My site is listed, but only got listed abouut 60 days into its uptime;
which, I'd imagine, is why they can't discern when my box was last booted.

My OS is listed as 'unknown', and it's got me miffed. :/

--

It's based on a database off odd tcp responses, checking which flags are
set in response packets and things like that.  It's fairly complex, but
the nmap source code is available if you really want to get into it.  You
could also search google for 'tcp fingerprinting' and find a lot of
documentation on the process.

Quote:>My site is listed, but only got listed abouut 60 days into its uptime;
>which, I'd imagine, is why they can't discern when my box was last booted.
>My OS is listed as 'unknown', and it's got me miffed. :/

These two things are probably related, its likely that your OS is too new,
too odd, or for some reason just not interesting enough for anyone to have
documented it's fingerprint.

--
Jason S Kohles                       A witty saying proves nothing.

http://www.jasonkohles.com/

Quote:>>My site is listed, but only got listed abouut 60 days into its uptime;
>>which, I'd imagine, is why they can't discern when my box was last booted.
>>My OS is listed as 'unknown', and it's got me miffed. :/

>These two things are probably related, its likely that your OS is too new,
>too odd, or for some reason just not interesting enough for anyone to have
>documented it's fingerprint.

Linux blackdeath 2.4.7 #4 Wed Jul 25 19:10:25 EDT 2001 i586 unknown

Has that been fingerprinted?

I don't see that the TCP stack would have changed that signifigantly during
these past few versions of the 2.4.x kernel.

--

Quote:> I noticed that they have a 'time since reboot' graph. I did not know
> that this data comes in the HTTP header. ( Does it.? ). So how did
> netcraft provide the graph.

Read the FAQ (link near top of page).

Excerpt:
The 'uptime' as presented in these reports is the "time since last
reboot" of the front end computer or computers that are hosting a site.
We can detect this by looking at the data that we record when we sample
a site. We can detect how long the responding computer(s) hosting a web
site has been running, and by recording these samples over a long period
of time we can plot graphs that show this as a line. Note that this is
not the same as the availability of a site.

--

Software Developer, Engineering Services
Red Hat, Inc.

QUIPd 0.20: (132 of 531)
-> Politics is the conduct of public affairs for private
-> advantage.
-> - Ambrose Pierce