Conference paper
Covert channels in the IP Time To Live Field
Australian Telecommunication Networks and Application Conference (ATNAC) 2006 (Melbourne, Australia, 04/12/2006–06/12/2006)
2006
Abstract
Covert channels are used for the secret transfer of information. Unlike encryption, which only protects the information from unauthorised observers, covert channels aim to hide the very existence of the communication. The huge amount of data and vast number of different network protocol s in the Internet makes it an ideal high-capacity vehicle for covert communication. Covert channels pose a serious security threat as they can be used for a number of malicious activities. In this paper we present a novel covert channel inside the IP header’s Time To Live (TTL) field. The sender manipulates the TTLs of subsequent packets transmitting covert information to the receiver. Since network elements along the path also modify the TTL, the capacity and stealth of this channel depend on the “natural” TTL variation. We analyse this variation in multiple traffic traces and propose an encoding scheme, which makes the TTL covert channel look similar to “natural” variation. We also discuss methods to eliminate and detect this covert channel
Details
- Title
- Covert channels in the IP Time To Live Field
- Authors/Creators
- S. Zander (Author/Creator)G. Armitage (Author/Creator)P. Branch (Author/Creator)
- Conference
- Australian Telecommunication Networks and Application Conference (ATNAC) 2006 (Melbourne, Australia, 04/12/2006–06/12/2006)
- Identifiers
- 991005545297707891
- Murdoch Affiliation
- Murdoch University
- Language
- English
- Resource Type
- Conference paper
Metrics
248 File views/ downloads
151 Record Views