HTTP responses reveal the internal clock of the web server that produces them. By tracking how many different clocks appear to be, halberd can have some insight into the number of real servers.
