Silence on the Wire

Chapter 11. In Recognition of Anomalies

Or what can be learned from subtle imperfections of network traffic

—

In the previous chapters, I dissected and analyzed a number of ways to extract chunks of potentially and likely valuable information from seemingly irrelevant, “technical” parameters supplied along with every message transmitted by a suspect over the network. As I hope you have seen, we can obtain a considerable amount of data on the sender that the sender is surely unaware of providing (or, at the very least, not very happy about often being unable to opt out of providing that data). Using a wide array of packet and stream analysis tricks, in a perfect and happy world we can measure many characteristics of the remote party and can map their ...