That sounds interesting, but I wonder if regularly setting your computer's clock via ntpd or ntpdate would defeat this. Having a sysctl MIB to turn off the TCP timestamping would certainly defeat this. I'll wager that if such doesn't already exist in the various BSD and Linux kernels, it will before too long.