Mostly true - but there is other information in the ethernet packets themselves - for example see https://www.informatik.tu-cottbus.de/~andriy/papers/clock-ske

Mostly true - but there is other information in the ethernet packets themselves - for example see https://www.informatik.tu-cottbus.de/~andriy/papers/clock-skew-ntp-ieee-globecom2012.pdf https://www.informatik.tu-cottbus.de/~andriy/papers/clock-sk... and there is information added during the routing - not just information from client - from the intermediates. And you also have to consider the power of patterns - where one piece isn't enough to see the picture, but if you have enough pieces you can ( jigsaw identification ).