Application Layer Covert Channel Analysis and ... - Bill Buchanan

Z. Kwecka, BSc (Hons) Network Computing, 2006 639 AppendicesAppendix 1 - Experiment 2 Results% OF RESPONSES30%25%20%15%10%5%0%Opera - 'User-Agent' Header200 301 302 304 404 500RESPONSE CODEForw ard ProxyFiltering ProxyResponses to Requests with ‘User-Agent’ Header Filtered OutA large number of responses with code ‘500’ signify remote servers havingproblems in processing requests with ‘User-Agent’ header missing.Internet Explorer- 'Host' Header% OF RESPONSES80%70%60%50%40%30%20%10%0%200 206 301 302 304 400 404RESPONSE CODEForw ard ProxyFiltering ProxyResponses to Requests with ‘Host’ Header Filtered OutThe graph shows that most of the servers treat requests with ‘Host’headers missing as valid, however a significant percent (5%)replies with code ‘400’, Bad Request. Further investigation foundusually less significant websites responded with this error code.