# Detecting Malicious Devices in IPSEC Traffic with IPv4 Steganography
## 3 IPsec-Based Network Steganography
### Proposed Method  
For this article, ESP in tunnel mode was explicitly selected for its encryption capabilities, which also extend to the encryption of the IP header. Figure 5: Structure of packets for AH and ESP transport and tunnel modes. In ESP tunnel mode, encryption is applied to the original IP packet, preventing any modifications to the encapsulated layers within the ESP. With minimal fields, the ESP header poses challenges for creating a covert storage channel. Figure 6 presents the specific structure of packet fields in this context. The encryption covers the portion from the IP header to the following header field in the original packet. Any attempts to modify the packet are impossible. Only the end host to which the packet is directed can decrypt it. This results from the encryption algorithm using a unique key to the hosts that have established connections. Furthermore, the Security Parameters Index (SPI) and sequence number in the ESP header are not designed for steganography. SPI is a 32-bit value in the ESP header that uniquely identifies a security association for the communication, the destination IP address, and the security protocol. On the other hand, sequence numbers help prevent replay attacks by ensuring each packet is unique within a specific time frame [58]. Therefore, the SPI must remain unchanged during communication, while the sequence number must be incremented by one for every packet. The only modifiable fields are those within the newly added IP header, which encapsulates the ESP header. In our approach, we have used the following IPv4 header fields:  
1. Identification--this field must be unique for each datagram in a single transmission. This means the field is static only when fragmentation occurs [59]. Therefore, if we  
Figure 6: ESP tunnel mode packet structure. ensure no fragmentation, it is possible to encode 2 bytes of covert data because there is no clear relationship between the generated numbers. 2. Time-to-live--this is an 8-bit field. Its value can range from 0 to 255. However, IPv4 is a best-effort protocol. This, combined with the expansion of the internet, makes it unnecessary to use all 8 bits provided for the TTL field. Therefore, it is possible to use the most significant bits to create a storage covert channel. Its bandwidth depends on whether the network is large or small. In addition to the identification and time-to-live fields, network packet headers have other essential fields, including flags containing reserved flags and fragment offset, which is important when fragmentation occurs. Another significant field is the type of service (TOS), which is vital in specifying the quality of service for the transmitted data. However, it is important to note that these additional fields have specific purposes and constraints, and their usage could be more flexible. Considering all possibilities of creating a covert channel within the IPv4 header, we can establish host-host communication where both devices are aware of the steganography communication scheme, ensuring its success. Nonetheless, in most established networks, multiple devices, such as routers, are along the path of packets. The communication schema for everyday traffic communication is illustrated in Figure 7.  
If any of these devices alters any of the header fields in between, the integrity of the covert channel will be compromised. This challenge can be addressed by implementing the proposed covert channel in the routing device. This implementation can function by either dropping the packet when an incorrect steganography message is received or by transmitting the MAC address of the compromised device to the destination host. The 48-bit MAC address is covertly embedded within the 16-bit identification field. We distribute the data across three distinct packets to facilitate efficient communication of this information. Moreover, the time-to-live field's most significant bits provide extra information about the identification field.