Clock skew
Definition
The difference between a device's local clock and a trusted reference time such as UTC. Skew accumulates due to hardware drift, timezone misconfiguration, or deliberate manipulation. Uncorrected skew causes log entries from different sources to appear out of sequence.
Related terms
- Anchor event
- A log entry that can be identified with high confidence across two or more log sources, used to verify relative clock offsets...
- DHCP lease log
- A record maintained by a Dynamic Host Configuration Protocol server that maps each IP address assignment to the requesting device's MAC address,...
- Log normalisation
- The conversion of log entries from their native format into a common schema, typically a structured record with a corrected UTC timestamp,...
- NAT (Network Address Translation)
- A mechanism by which a router replaces private source IP addresses with a single public IP address before forwarding packets to the...
- Session tuple
- The five-element identifier for a network session: source IP, source port, destination IP, destination port, and protocol. The session tuple is the...
Explained in
- Reconstructing a Network Timeline from Multiple SourcesThe difference between a device's local clock and a trusted reference time such as UTC. Skew accumulates due to hardware drift, timezone misconfiguration, or d...