2

This may sound like a stupid question, but I noticed there are a lot of unused/reserved fields in many headers of the different TCP/IP layers.
For example, bits 100 to 103 in the TCP header are unused and should be to set 0. There are also the unused padding fields at the end.

Are the values in those fields preserved over the network? When a packet is reconstructed every time it traverses the different network nodes, is it possible that one of them does an optimization by skipping or assuming those fields are using the default usual values and sets those fields to 0 for example?

In other words, can two devices send over the network something similar to Morse code hidden in, for example, the reserved fields of ICMP headers or anything similar?

migrated from security.stackexchange.com Jul 9 '16 at 12:28

This question came from our site for information security professionals.

  • This is the wrong site @root. Even if you are asking this for an infosec reason, the question has more to do with the implementation of network hardware and software. I've started the migration process to get this to the right spot - I think superuser.com, but am not 100% sure. We'll see what others think. – Neil Smithline Jul 8 '16 at 22:09
  • @Neil sorry i didn't know , i'll delete if necessary – root Jul 8 '16 at 22:11
  • 1
    Not a problem. The community (which moderates this site) will migrate it to the appropriate site. And other users may disagree and feel it belongs here. It looks like @SteffenUllrich has already given you a good answer. – Neil Smithline Jul 8 '16 at 22:15
7

There is no such thing as "the network" which behaves the same everywhere. The network is made of routers which simply forward packets unchanged. Then you have packet filter firewalls which might pass such packets unchanged, might block these if the reserved bits are set or might sanitize the packets by setting the reserved bits to zero. And then you have application level gateways/firewalls which effectively are an endpoint for the TCP connection and which create a new connection consisting of different packets and of course the reserved bits set to a sane value.

in other words can two devices send over the network something similar to morse code hidden in ,for example, the reserved fields of ICMP headers or anything similar?

There are enough side channels how devices can communicate in a hidden way. This can be such reserved bits, timing or size of messages, application layer information like extra spaces or differentiating between upper and lower cases in text based protocols, steganographic techniques etc. Depending on the abilities of the devices of the network such side channel information will pass without changes, might be inadvertently removed or might be explicitly removed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy