I built a tool that detects physical hardware vs VMs by measuring TCP Clock Skew (Rust + Raw Sockets)

Hi everyone,

I wanted to share a research tool I've been working on called Chronos-Track. It's an active fingerprinter that tries to distinguish physical servers from virtual machines/honeypots by analyzing the microscopic drift of their quartz crystal oscillators (Clock Skew).

How it works:

1. Sends raw TCP SYN packets with customized jitter to evade detection.
2. Uses iptables to suppress the local kernel's RST packets (half-open scanning).
3. Captures timestamps using AF_PACKET ring buffer for nanosecond precision.
4. Calculates the skew using an iterative lower-bound convex hull algorithm (implemented in pure Rust).

It was a great way to learn about the Linux networking stack and Rust's FFI. I'd love to hear your thoughts on the code or the approach!

Repo: https://github.com/Noamismach/chronos_track/tree/v1.2