What benefit is conferred by TCP timestamp?

Question

I have a security scan finding directing me to disable TCP timestamps. I understand the reasons for the recommendation: the timestamp can be used to calculate server uptime, which can be helpful to an attacker (good explanation under heading "TCP Timestamps" at http://www.silby.com/eurobsdcon05/eurobsdcon_silbersack.pdf).

However, it's my understanding that TCP timestamps are intended to enhance TCP performance. Naturally, in the cost/benefit analysis, performance degradation is a big, possibly too big, cost. I'm having a hard time understanding how much, if any, performance cost there is likely to be. Any nodes in the hivemind care to assist?

Answer 1

The answer is most succinctly expressed in RFC 1323 - Round-Trip Measurement... The introduction to the RFC also provides some relevant historical context...

   Introduction     The introduction of fiber optics is resulting in ever-higher    transmission speeds, and the fastest paths are moving out of the    domain for which TCP was originally engineered.  This memo defines a    set of modest extensions to TCP to extend the domain of its    application to match this increasing network capability.  It is based    upon and obsoletes RFC-1072 [Jacobson88b] and RFC-1185 [Jacobson90b].     (3)  Round-Trip Measurement         TCP implements reliable data delivery by retransmitting        segments that are not acknowledged within some retransmission        timeout (RTO) interval.  Accurate dynamic determination of an        appropriate RTO is essential to TCP performance.  RTO is        determined by estimating the mean and variance of the        measured round-trip time (RTT), i.e., the time interval        between sending a segment and receiving an acknowledgment for        it [Jacobson88a].         Section 4 introduces a new TCP option, "Timestamps", and then        defines a mechanism using this option that allows nearly        every segment, including retransmissions, to be timed at        negligible computational cost.  We use the mnemonic RTTM        (Round Trip Time Measurement) for this mechanism, to        distinguish it from other uses of the Timestamps option. 

The specific performance penalty you incur by disabling timestamps would depend on your specific server operating system and how you do it (for examples, see this PSC doc on performance tuning). Some OS require that you either enable or disable all RFC1323 options at once... others allow you to selectively enable RFC 1323 options.

If your data transfer is somehow throttled by your virtual server (maybe you only bought the cheap vhost plan), then perhaps you couldn't possibly use higher performance anyway... perhaps it's worth turning them off to try. If you do, be sure to benchmark your before and after performance from several different locations, if possible.