There was a project on GitHub that (was going to, if it hadn't been abandoned) modify TCP fields in order to evade packet sniffing. It explains in specifics how this would work here. In particular, this is what's specified:
- packets with a short time to live (TTL).
this technique obtains the objective manipolating the ttl of the packet the ttl chosen is a random one shorter than the one requested to get to the destination.
the real ttl value is calculated at regular intervals using an optimized algoritm based on the traceroute.
- packets with bad ip options.
this technique obtains the objective manipoulating the IP and TCP header options of the packet;
here, following some RFC guidelines and exploiting the differences between various operative systems we use some particular invalid ip option leading the destination to drop the packet.
every ISP treat the IP options in different ways. as explained in the location autodetect, and the configuration file iptcp-options.conf describe which kind of IP/TCP options will be accepted in our ISP, and which possibility you have to use them to scramble the packets.
Some IP options is rejected with an ICMP parameter problem (and this is a problem!), some other are discarded by the remote host (and this is an useful scramble, because the sniffer will not know if the IP option has been accepted or not), some options are not accepted in proposed twice in the same header, and some options is not accepted on a specific status of the session. This combos are automatically tested and used in the best combinations during the obfuscation.
- packet with bad tcp checksum.
this technique obtains the objective altering the tcp checksum of the packet;
this is probably one of the oldest technique conceived and it's mantained only for this reason because it has also some drawbacks.
in fact, while working with quite all destinations, this tecnique altering the checksum leads quite all tcp implementation to a windows resize causing performance degradation.
I guess my question is, do these concepts work? I don't know why this project died all those years ago, but do the concepts behind it's fruition stand today?