Ncovert2 – How it works, pt.4

• Packets sent until all data is transmitted

• Source address is only required on the first packet, so source addresses can be changed to something “random”, including decoy packets

• Transmission should look like a TCP ping to port 80 followed by a full port scan, with random source addresses

Notes: