Covert channels are desirable to exltrate sensitive infor-
mation for several reasons. One, the use of a normal com-
munications channel (such as an FTP or HTTP connection)
is easily detected by wardens looking for malicious trac.
This type of trac can be captured in log les and traf-
c dumps, and then analyzed and prevented. Making the
communication channel more obscure, by methods such as
using nonstandard port numbers, is also easily detectable
and would trigger mechanisms such as packet anomaly de-
tection systems [2].