Chapter 3 Time-to-live Covert Channels - CAIA

Throughput (bits/s)
200
150
100
50
0
●
●
CHAPTER 3. TIME-TO-LIVE COVERT CHANNELS
●
●
●
●
scp A−>B
scp B−>A
Q3 A−>B
Q3 B−>A
0.000 0.002 0.004 0.006 0.008 0.010
TTL error rate
SSH A−>B
SSH B−>A
Figure 3.25: Throughput depending on the TTL error rate for 0% packet loss and reordering
Throughput (bits/s)
200
150
100
50
0
●
●
●
●
scp A−>B
scp B−>A
●
● ● ●
Q3 A−>B
Q3 B−>A
0.0 0.2 0.4 0.6 0.8 1.0
Packet loss rate
●
●
SSH A−>B
SSH B−>A
Figure 3.26: Throughput depending on the packet loss rate with 0.1% TTL error rate and 0%
packet reordering
We used smaller code lengths for the testbed experiments to increase the total number
of blocks, given that the packet rates were much smaller than the rates in the traces.
Because of the smaller block sizes and the higher redundancies the code rates are smaller
than in the trace-file analysis.
Figure 3.25, 3.26 and 3.27 show the throughput for the different applications and
error rates. For scp the data was transferred from Alice to Bob and hence the rate of
overt packets in that direction is higher. For Q3 the throughput from Alice to Bob is
much larger, as Alice’s host running the Q3 client sent one packet every 10–20 ms, but
Bob’s host running the server only sent one packet every 50 ms [190]. SSH throughput is
roughly symmetric with the used shell commands.
Figure 3.28 shows the percentage of the channel capacity reached for the different
applications averaged over both directions. The percentage should be roughly equal for all
applications. However, SSH performs worse since the number of data blocks transmitted
70
●
●