Abstract: A method and system for the post-adjustment (i.e., offline) of event timestamps to implement virtual time synchronization amongst detection node clocks. In existing methodologies with the goal of clock synchronization, clocks (and timestamps generated therefrom) are disciplined or adjusted at the recordation time of the events on a detection node (e.g., a switch/router, an Internet-of-Things (IoT) device, a wireless sensor, etc.). However, there is no particular reason for these clocks or timestamps to be accurate during the recordation time, but rather, should be accurate at their use or interpretation time. Further, through these recordation time adjustments, clock drifts and timing errors may be gradually introduced, leading to runaway inaccuracies. The disclosed method and system intentionally avoids the disciplining of clocks at event recordation times on the detection node and, instead, adjusts timestamps during interpretation times, to overcome the aforementioned issues.

Abstract: A method and system for the post-adjustment (i.e., offline) of event timestamps to implement virtual time synchronization amongst detection node clocks. In existing methodologies with the goal of clock synchronization, clocks (and timestamps generated therefrom) are disciplined or adjusted at the recordation time of the events on a detection node (e.g., a switch/router, an Internet-of-Things (IoT) device, a wireless sensor, etc.). However, there is no particular reason for these clocks or timestamps to be accurate during the recordation time, but rather, should be accurate at their use or interpretation time. Further, through these recordation time adjustments, clock drifts and timing errors may be gradually introduced, leading to runaway inaccuracies. The disclosed method and system intentionally avoids the disciplining of clocks at event recordation times on the detection node and, instead, adjusts timestamps during interpretation times, to overcome the aforementioned issues.

Abstract: Techniques for determining a clock offset between monitoring devices in a network. Such techniques include: obtaining, by a first monitoring device, a first set of network traffic data units sent between a first endpoint and a second endpoint via a first tap on a network link between the first endpoint and second endpoint; obtaining, by a second monitoring device, a second set of network traffic data units sent between the first endpoint and the second endpoint via a second tap on the network link; calculating the clock offset between the first monitoring device and the second monitoring device using the first set of network traffic data units and the second set of network traffic data units; and performing an offset action based on the clock offset.

Abstract: A method and system for the post-adjustment (i.e., offline) of event timestamps to implement virtual time synchronization amongst detection node clocks. In existing methodologies with the goal of clock synchronization, clocks (and timestamps generated therefrom) are disciplined or adjusted at the recordation time of the events on a detection node (e.g., a switch/router, an Internet-of-Things (IoT) device, a wireless sensor, etc.). However, there is no particular reason for these clocks or timestamps to be accurate during the recordation time, but rather, should be accurate at their use or interpretation time. Further, through these recordation time adjustments, clock drifts and timing errors may be gradually introduced, leading to runaway inaccuracies. The disclosed method and system intentionally avoids the disciplining of clocks at event recordation times on the detection node and, instead, adjusts timestamps during interpretation times, to overcome the aforementioned issues.

Abstract: Techniques described herein may be used for determining an offset between clocks in a network. Such techniques may include obtaining, by a passive time device, a first timestamp pair corresponding to a first time protocol message; obtaining, by the passive time device, a second timestamp pair corresponding to a second time protocol message; and calculating, by the passive time device, a clock offset between a time protocol master and the passive time device using the first timestamp pair, the second timestamp pair, and a pre-determined time delay constant corresponding to a network tap.

Abstract: Techniques described herein may be used for determining an offset between clocks in a network. Such techniques may include obtaining, by a passive time device, a first timestamp pair corresponding to a first time protocol message; obtaining, by the passive time device, a second timestamp pair corresponding to a second time protocol message; and calculating, by the passive time device, a clock offset between a time protocol master and the passive time device using the first timestamp pair, the second timestamp pair, and a pre-determined time delay constant corresponding to a network tap.

Abstract: Techniques for determining a clock offset between monitoring devices in a network. Such techniques include: obtaining, by a first monitoring device, a first set of network traffic data units sent between a first endpoint and a second endpoint via a first tap on a network link between the first endpoint and second endpoint; obtaining, by a second monitoring device, a second set of network traffic data units sent between the first endpoint and the second endpoint via a second tap on the network link; calculating the clock offset between the first monitoring device and the second monitoring device using the first set of network traffic data units and the second set of network traffic data units; and performing an offset action based on the clock offset.