LBL

IP Header Side Channel4-bit

Version4-bit

HeaderLength

8-bitType of Service

(TOS)16-bit Total Length (Bytes)

16-bit Identification3-bitFlags 13-bit Fragment Offset

8-bit Time to Live (TTL) 8-bit Protocol 16-bit Header Checksum

32-bit Source IP Address

32-bit Destination IP Address

Payload

ID field issupposed to beunique per IPpacket.

One easy way todo this: incrementit each timesystem sends anew packet.

SYN-ACK

SYN-ACK

SYN-ACK

SYN-ACK

SYN-ACK

Spoofed

SYN-ACK

SYN-ACK

SYN-ACK

Upon receiving RST,Patsy ignores it and doesnothing, per TCP spec.

SYN-ACK

SYN-ACK

SYN-ACK

SYN-ACKSpoofed

SYN-ACK

SYN-ACK

10s of seconds later

1 month later

If orders are timer-driven, expectnarrow range of timing errorsreflecting batch size.

If skewed by outliers, expectup/down or down/up trend aroundoutlier.

If orders not timer-driven, then wejust see residuals with respect tounderlying order rate ⇒ shouldhave a cloud of points