Chapter 3 Time-to-live Covert Channels - CAIA

CHAPTER 3. TIME-TO-LIVE COVERT CHANNELS
Table 3.1: Packet traces used in the analysis
Trace Capture location Date Public
CAIA Public game server at Swinburne University,
Melbourne, Australia
Grangenet Public game server connected to Grangenet,
Canberra, Australia
05/2005 – 06/2006 no
05/2005 – 06/2006 no
Twente Uplink of ADSL access network [165] 07/02/2004 – 12/02/2004 yes
Leipzig Access router at Leipzig University [166] 21/02/2003 yes
Bell Firewall at Bell Labs [166] 19/05/2002 – 20/05/2002 yes
Waikato Access router at University of Waikato, New
Zealand
04/05/2005 no
We evaluate the throughput of the developed reliable transport technique for aggregate
overt traffic taken from traces under different simulated network conditions. We also
analyse the throughput across a real network with different rates of TTL errors, overt
packet loss and reordering, using single overt traffic flows as carrier. Comparison of the
results with the channel capacity shows that our technique is not optimal, but it provides
throughputs of at least 50% of the capacity, except in the case of high reordering. The
throughput is up to over hundred bits per second.
3.1 Normal TTL variation
First we analyse ‘normal’ TTL variation (TTL noise). We analyse how TTL varies at
small time scales of subsequent packets of traffic flows (series of packets with the same
IP addresses, ports, and protocol) and not only focus on variation caused by path changes
as previous work [161, 162, 163, 164]. An extended version of this study is in [9].
3.1.1 Datasets and methodology
We use packet traces of different size, origin and date for our analysis (see Table 3.1). The
CAIA trace contains only game traffic arriving at a public game server, the Grangenet
trace contains game and web traffic arriving at a specific server, and the other traces
contain a mix of bidirectional traffic.
Usually analysis of network traffic is based on packet flows. Because we found the
number of TTL changes is correlated with the number of packets and the duration of
flows, we analyse many characteristics of TTL changes based on packet pairs, defined
as two subsequent packets of a flow. This isolates the characteristic under study (e.g.
estimated hop count) from correlated flow properties (e.g. size and duration). However,
for analysis requiring a sequence of packets we still use flows (e.g. in Section 3.1.4).
39