# A Novel Covert Channel for IEEE 802.11 Networks Utilizing MAC Address Randomization
## 8 Discussion  
In this study, we investigated two scenarios for covert data transmission and explored a transmission technique to enhance its performance in dense environments. Our findings indicate that the number of stations and the TI has a direct impact on network performance and delay. To address longer transmission intervals or an increased number of stations, retransmission can be employed, resulting in significant improvements in network throughput and efficiency. However, it also introduces additional delay and jitter. On the other hand, the adoption of the SWP allows stations to consecutively send messages without waiting for acknowledgment or freezing when there is a high external load. Our observations demonstrate that implementing SWP leads to enhanced throughput, improved efficiency, and reduced delay and jitter. This technique proves to be highly beneficial in dense environments. Furthermore, the covert channel exhibits versatility and can operate in three different modes depending on network conditions, including the number of stations, offered load, and desired sender throughput. Table 2 provides a summary of the key aspects of each experiment, including the highest throughput values, corresponding frame efficiency, delay, and the methods employed to achieve these results. It is worth noting that all transmission techniques utilized a uniform transmission interval of 10 ms.  
Figure 19: Covert channel jitter after the adoption of sliding window protocol. Figure 18: Covert channel delay after the adoption of sliding window protocol. We also outline some of the key distinguishing characteristics of our research on covert channels compared to existing implementations based on the IEEE 802.11 MAC layer. We emphasize the significance of these characteristics in advancing the field of IEEE 802.11 networks steganography, with the ultimate goal of designing and implementing covert channels that are both resilient and secure while maintaining transparency and reliability. * **High covertness**: The covert messages are based on the IEEE 802.11 specifications and recommendations and exploit the open aspects of the standard. The covert channel is camouflaged as a MAC randomization technique in the PR frames. The MAC address is randomly disposable, carrying no special meaning. If detected, the frames can be considered one of the many flavors of MAC randomization. MAC randomization is an advocated practice during scanning, is not standardized, and currently is a vendor specification. * **Robust security**: If the covert channel is detected due to the random nature of the message content, to interpret the message correctly, the third party still needs the dictionary shared between sender and receiver, which adds an extra layer of security. Even though the MAC address is plain text, the covert message is not. * **Data reliability**: Data reliability needs to be addressed in the IEEE 802.11 covert channel. To demonstrate the importance of reliability, we compared a covert channel with and without retransmission, and the results confirmed the profits of enabling retransmission. * **Transparency**: A covert channel should not have any interference with regular network functionality. This study proves we can implement a covert channel that coexists with everyday devices generating regular application traffic, such as UDP or TCP. * **High throughput**: It is crucial to mention that the primary focus of the covert channel is to enable secret data flow within a regular transmission channel. In this work, we combine allowing secret data exchange with high throughput in the order of kilobytes per second. Compared to the existing IEEE 802.11 MAC covert channel, it is multiples times higher and considered a very satisfactory result. Considering the inherent nature of IEEE 802.11 networks, where all stations sharing the transmission channel can hear each other, it becomes possible for any IEEE 802.11 devices to capture and potentially decrypt the traffic within that channel.