I)ruid [CAU] - Steganography Primer

Network Steganography

Modify Existing Network Traffic

Create new traffic emulating legitimate traffic

Make use of otherwise unused or un-needed fields in network protocol headers

Modify protocol header values that are being used

Depending on data type, even the payload of the network traffic could be used


	•Messages can be embedded into existing network traffic that a host is generating or a host is forwarding.
	•Also, network traffic can be generated specifically for the steganographic communication.
	•Some protocol headers have fields that are reserved for future use, only used under certain circumstances, or become irrelevant or un-needed as it traverses the network stack.
	•Depending on the data type, you may even be able to use the data payload as a cover-medium.