ICMP Timestamp Request Remote Date Disclosure

Question

ICMP Timestamp Request Remote Date Disclosure

Jay Tee 40

How to fix ("ICMP Timestamp Request Remote Date Disclosure") for Windows servers

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

3 answers

Answer 1

Hi Jay Tee,

Firewall rules take effect immediately after creation/modification.

No system restart is required for Windows Firewall changes to apply.

I would like to add option 3

# Create firewall rule to block ICMP Timestamp requests
New-NetFirewallRule -DisplayName "Block ICMP Timestamp" -Direction Inbound -Protocol ICMPv4 -IcmpType 13 -Action Block -Enabled True

Best regards,

Alex

P.S. If my answer help to you, please Accept my answer

Answer 2

Anonymous

Hello Jay Tee,

Thank you for posting in Q&A forum.

To address the "ICMP Timestamp Request Remote Date Disclosure" issue on Windows Server 2019, you can follow these steps:

You can disable ICMP Timestamp Reply by modifying the registry. Please back up the registry before making any changes. Here are the steps:

• Open the Registry Editor (regedit).

• Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters.

• Create a new DWORD value named DisableICMPRedirect and set its value to 1.

• Restart the server for the changes to take effect.

You can also use Windows Firewall to block ICMP Timestamp requests and replies:

• Open the Windows Firewall with Advanced Security.

• Create a new inbound rule to block ICMPv4 and ICMPv6 Echo Request messages.

• Create a new outbound rule to block ICMPv4 and ICMPv6 Echo Reply messages.

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Jay Tee 40 Reputation points

2025-03-26T15:24:12.18+00:00

@Daisy Zhou If I go with option 2, do I still have to restart the server?
Jay Tee 40 Reputation points

2025-03-27T08:15:30.6766667+00:00

@Daisy Zhou If I go with option 2, do I still have to restart the server?
michaelho 0 Reputation points

2025-09-05T07:20:16.65+00:00

Both options are wrong.
Option 1
The register value DisableICMPRedirect is not relevant to the ICMP Timestamp Request issue.

Option 2

The ICMP Echo Request is type 8, but the Timestamp Request is type 13. The answer you provided just disables response to Ping requests, not the Timestamp request.

Actually, I searched and tested several claimed solutions by modifying the registry value, but all of them are incapable of disabling the ICMP timestamp response (ICMP type 14). Up to now, I have found the only workable solution is to turn on the Windows Firewall. It blocks all traffic except for that allowed in the firewall rules. By default, there are no rules to allow the ICMP timestamp request.

Answer 3

Actually, you don't need a specific rule to block the ICMP Tmestamp Request. The Windows Firewall by default blocks all traffic unless they are allowed by firewall rules. Your server should not have any rules to allow this type of ICMP traffic unless they are added intentionally. The essential things are to enable the Windows Firewall on that server and remove the rules that allow ICMP Timestamp Request (Type 13), if any exist.