This method also does not require an established connection between the two systems. Here, one hidden character is encapsulated per SYN request and reset packet.

This method also does not require an established connection between the two systems. Here, one hidden character is encapsulated per SYN request and reset packet.

• A. DNS tunneling
• B. TCP Initial Sequence Number
• C. Bash
• D. IP Identification Field

Answer: (B)

Encoding data in the TCP Initial Sequence Number creates a covert channel that doesn’t require a full TCP connection. In this technique, each SYN request carries a crafted initial sequence number that encodes a character or small payload. A subsequent reset packet tears down the attempt, so no legitimate connection is established. Because no established session is needed, the receiver (or anyone monitoring the traffic) can observe the ISN values in the SYNs and reconstruct the hidden message over multiple such exchanges. This precisely matches the idea of sending one hidden character per SYN request and reset sequence without forming a real connection. DNS tunneling would rely on legitimate DNS queries and responses to shuttle data, not on SYN/RST traffic. The IP Identification field and Bash are unrelated to this method; they don’t describe a covert channel that uses TCP’s ISN in conjunction with a SYN and a reset to transmit data without a real connection.

Encoding data in the TCP Initial Sequence Number creates a covert channel that doesn’t require a full TCP connection. In this technique, each SYN request carries a crafted initial sequence number that encodes a character or small payload. A subsequent reset packet tears down the attempt, so no legitimate connection is established. Because no established session is needed, the receiver (or anyone monitoring the traffic) can observe the ISN values in the SYNs and reconstruct the hidden message over multiple such exchanges. This precisely matches the idea of sending one hidden character per SYN request and reset sequence without forming a real connection.

DNS tunneling would rely on legitimate DNS queries and responses to shuttle data, not on SYN/RST traffic. The IP Identification field and Bash are unrelated to this method; they don’t describe a covert channel that uses TCP’s ISN in conjunction with a SYN and a reset to transmit data without a real connection.