Steganography in Handling Oversized IP Packets

TL;DR

This paper explores how IP fragmentation and MTU discovery mechanisms can be exploited for network steganography, proposing new methods, extensions, and detection techniques for both IPv4 and IPv6.

Contribution

It introduces two novel steganographic methods and extensions leveraging IP fragmentation and MTU mechanisms, enhancing covert communication capabilities.

Findings

New steganographic methods utilizing IP fragmentation and MTU mechanisms.

Extensions of existing steganography techniques for improved covert communication.

Detection strategies for the proposed steganographic methods.

Abstract

This paper identifies new class of network steganography methods that utilize mechanisms to handle oversized packets in IP networks: IP fragmentation, PMTUD (Path MTU Discovery) and PLPMTUD (Packetization Layer Path MTU Discovery). In particular, we propose two new steganographic methods and two extensions of existing ones. We show how IP fragmentation simplifies utilizing steganographic methods which requires transmitter-receiver synchronization. We present how mentioned mechanisms can be used to enable hidden communication for both versions of IP protocol: 4 and 6. Also the detection of the proposed methods is enclosed in this paper.