The ICMP timestamp request message allows a host to ask for the current time according to the remote host. The remote host uses an ICMP timestamp reply message to respond to the request.

The type field on an ICMP timestamp message can be either 13 (timestamp request) or 14 (timestamp reply). The code field value is always set to 0 because there are no additional parameters available. The ICMP timestamp request contains an originate timestamp, which is the time on the requesting host just before the timestamp request is sent. The receive timestamp is the time that the destination host receives the ICMP timestamp request. The transmit timestamp is filled in just before the ICMP timestamp reply is returned. Originate, receive and transmit timestamps are computed in numbers milliseconds elapsed since midnight Universal Time (UT).

All ICMP timestamp reply messages contain the originate, receive and transmit timestamps. Using these three timestamps, the host can estimate transit time across the network by subtracting the originate time from the transit time. It is only an estimate however, as true transit time can vary widely based on traffic and congestion on the network. The host that originated the timestamp request can also estimate the local time on the remote computer.

While ICMP timestamp messages provide a simple way to estimate time on a remote host and total network transit time, this is not the best way to obtain this information. Instead, more robust protocols such as Network Time Protocol (NTP) at the upper layers of the TCP/IP protocol stack perform clock synchronization in a more reliable manner. 

Web Links Clock Synchronization Algorithms for Network Measurements http://www.ieee-infocom.org/2002/ papers/329.pdf