Covert channel for local area network

Abstract

There exist many TCP/IP covert channels in WAN for network hidden communication in last decades. However, there are few covert channels designed for the LAN while existing WAN covert channels could not be adapted for the LAN applications. In this paper we proposed a novel covert channel based on ARP broadcasting packets for LAN. In our method we employed the normal ARP request packets as the carrier which could escape feature-based detections. In addition, our method would not lead to abnormal network traffic. Experimental results show that our covert channel has great resistance to not only the feature-based detections but also the network traffic detections.