Timing Channel
Definition
A covert channel that encodes information in the intervals between network events, such as inter-packet delays, rather than in packet content. Timing channels leave no payload evidence and require statistical traffic analysis to detect.
- Type
- Covert network channel
- Encodes information in
- Intervals between network events, e.g. inter-packet delay
- Leaves
- No payload evidence
- Detection method
- Statistical traffic analysis
Common questions
Why can't payload inspection catch a timing channel?+
A timing channel carries its message entirely in when packets are sent, not in what they contain, so packets can look completely normal and benign to signature-based or content-inspection tools while still leaking data through their spacing.
What does statistical detection of a timing channel actually look for?+
Analysts look for inter-packet delay patterns that deviate from the natural jitter of legitimate traffic, such as unusually regular or bimodal timing distributions, which suggest delays are being deliberately controlled rather than arising from normal network conditions.
Related terms
- Covert Channel
- Any communication path that was not intended by the system designer and that bypasses access-control or monitoring policies. Network covert channels are...
- DNS Tunnelling
- Encoding data inside DNS queries and responses to exfiltrate information or carry command-and-control traffic through a network that permits DNS but blocks...
- Entropy Analysis
- A statistical technique that measures the randomness of data in a field or stream. Protocol fields that should contain low-entropy predictable values...
- Protocol Anomaly Detection
- A detection method that compares observed network traffic against the formal specification of each protocol (its RFC or standard) and flags fields...
- Storage Channel
- A covert channel that encodes information in the value of a protocol field, such as the IP Identification field or a DNS...