Search Swinburne Research Bank
Please use this identifier to cite or link to this item: http://hdl.handle.net/1959.3/25237
 Download PDF (Published version) (Adobe Acrobat PDF, -1 bytes) |
- Title
- Covert channels in the IP time to live field
- Author(s)
- Zander, Sebastian; Armitage, Grenville J.; Branch, Philip A.
- Abstract
- Covert channels are used for the secret transfer of information. Unlike encryption, which only protects the information from unauthorised observers, covert channels aim to hide the very existence of the communication. The sheer amount of data and vast number of different network protocols in the Internet makes it an ideal high-capacity vehicle for covert communication. Covert channels pose a serious security threat as criminals can use them to hide their communication activities. In this paper we present a novel covert channel inside the IP header’s Time To Live (TTL) field. The sender manipulates the TTLs of subsequent packets transmitting covert information to the receiver. Since network elements along the path also modify the TTL, the capacity and stealth of this channel depend on the 'natural' TTL variation. We analyse this variation in multiple traffic traces and propose an encoding scheme, which makes the TTL covert channel look similar to “natural” variation. We also discuss methods to eliminate and detect this covert channel.
- Publication type
- Conference paper
- Research centre
- Swinburne University of Technology. Faculty of Information and Communication Technologies. Centre for Advanced Internet Architectures
- Source
- Proceedings ATNAC 2006 : Australian Telecommunication Networks and Applications Conference, Melbourne, Victoria, Australia, 04-06 December 2006, p. 298-302
- Publication year
- 2006
- Keyword(s)
- Security; Covert channels; Network protocols
- Publisher
- University of Melbourne
- ISBN
- 0977586103
- Publisher URL
- http://www.ee.unimelb.edu.au/atnac2006/programs/day2.html
- Copyright
- Copyright © 2006 ATNAC Australia. Published version of this paper reproduced with the kind permission of the publisher.
- Full text
- Peer reviewed
