Revision history [back]

The answer to your question is "only if there's a network protocol whose packets include those times and the machine sends them, or if there's a packet that you know the machine will send early in the boot process".

If, for example, the machine uses DHCP to get configuration information when it boots, and you happen to have a record of when that machine sent out its boot-time DHCP packet - either from a traffic capture or from a log on the DHCP server - you could infer an approximate boot time (not necessarily the time the CPU was reset, and not necessarily the time the machine was up and fully ready for operation, but probably close enough).

And if it happens to, for example, do a DNS query for a particular name at boot time (and either never ever queries for it again or queries differently, you might be able to get that information from the DNS server, if it keeps a log of those requests.

The answer to your question is "only if there's a network protocol whose packets include those times and the machine sends them, or if there's a packet that you know the machine will send early in the boot process".

If, for example, the machine uses DHCP to get configuration information when it boots, and you happen to have a record of when that machine sent out its boot-time DHCP packet - either from a traffic capture or from a log on the DHCP server - you could infer an approximate boot time (not necessarily the time the CPU was reset, and not necessarily the time the machine was up and fully ready for operation, but probably close enough).

And if it happens to, for example, do a DNS query for a particular name at boot time (and either never ever queries for it again or queries differently, you might be able to get that information from the DNS server, if it keeps a log of those requests.