Diffusion: Zero Cost Information Dissemination
Packet headers and trailers exhibit considerable coding redundancy
from both a theoretical and a practical standpoint. Diffusion
exploits this redundancy to create an additional communication channel
between hosts as a by-product of normal packet transfers. This
channel is zero cost: the number and size of packets transfered does
not change. Dissemination of dynamic resource information is a
natural user of such a channel.
SpyTalk allows users (spies) to communicate surreptitiously using
Diffusion techniques. SpyTalk looks like the Unix
talk program, the great grand-daddy of all instant messaging
programs. In addition to user messages, SpyTalk hosts exchange
The following screen shot shows a typical SpyTalk screen. In this
example, SpyTalk data is being piggybacked on existing IP packets
traveling between the two hosts. No additional packets are being
sent and no packets are enlarged. The necessary packet stream is
being provided by having one of the two hosts repeatedly ping the
other. However, any IP packets traveling between the hosts could provide
SpyTalk's surreptitious communication channel.
The Diffusion techniques are implemented as a pair of Linux kernel
modules that export send and receive interfaces via the /proc
filesystem. SpyTalk itself is implemented as a Perl program that
sends and receives using the /proc interfaces. SpyTalk was
written by Brian Cornell. The Diffusion Modules were written by
Brian and Jack Lange.
The LoadBanner client shows the current load of all hosts on the
local area network that are running the LoadBanner server. The
LoadBanner server piggybacks load measurements on ARP request
packets. A host broadcasts an ARP request to the network whenever
it needs to send a packet and has no ARP entry in its cache for
the destination address. ARP entries expire from the cache after
some time. Because ARP requests are broadcast, all the hosts on
the LAN see them. The hosts running the LoadBanner client extract
the load information and display it. As with SpyTalk, the packet
editing takes place in the Diffusion kernel modules which the
LoadBanner client and server talk to via /proc interfaces.
The Linux implementation of Diffusion, which includes kernel
modifications, kernel modules, the /proc interface, the C API,
SpyTalk, and LoadBanner is available.
This material is based upon work supported by the National Science
Foundation under Grant No. ANI-0093221, including a Research
Experience for Undergraduates (REU) Supplement. Any opinions,
findings and conclusions or recommendations expressed in this
material are those of the author(s) and do not necessarily reflect
the views of the National Science Foundation (NSF).
Last modified: Mon Jul 17 13:51:30 CDT 2006