Quote:
Originally Posted by BigD  Suspicious transmissions would be flagged up as non-standard encoding of traffic in a voice application for example. A low bandwidth voice is expected to be encoded in a certain way. If someone that knew the protocol for voice encoding, start of message frame , on a closed channel (multiplexing obviously makes it more difficult) etc etc, could recognise that your data payload does not correspond with the characteristics of open-traffic. That would set alarm bells ringing without you having to do anything.
I have no direct knowledge of any of this in use other than I would be very surprised if such alarms are not already in use.
BigD |
It's pretty easy to identify encrypted voice traffic but then it could be tunneled though an ssh tunnel (a VPN) for example and there is no way of knowing what that carries. You'd have to accept that some traffic you will not be able to sniff, or block certain types of ssl traffic which has it's own limitations.