Author here.
I built this tool to solve a specific problem in reconnaissance: distinguishing between a real physical machine (bare metal) and a virtualized honeypot.
The core idea:
Physical computers use quartz crystals for their clock, which have microscopic imperfections and drift (clock skew) unique to the hardware. Virtual machines and honeypots typically sync their clocks via the hypervisor, creating a different "too perfect" or chaotic timing signature.
How Chronos-Track works:
It creates an active connection using raw TCP SYN packets with TSopt headers.
It measures the reply timestamps with nanosecond precision using SO_TIMESTAMPING.
It applies a Convex Hull regression algorithm to filter out network jitter and isolate the linear drift of the crystal.
It’s written in Rust and includes a TUI (using Ratatui) to visualize the drift in real-time.
I'd love to hear your feedback on the methodology or the Rust implementation!
Ismach•2h ago