This may sound like a stupid question, but I noticed there are a lot of unused/reserved fields in many headers of the different TCP/IP layers.
For example, bits 100 to 103 in the TCP header are unused and should be to set 0. There are also the unused padding fields at the end.
Are the values in those fields preserved over the network? When a packet is reconstructed every time it traverses the different network nodes, is it possible that one of them does an optimization by skipping or assuming those fields are using the default usual values and sets those fields to 0 for example?
In other words, can two devices send over the network something similar to Morse code hidden in, for example, the reserved fields of ICMP headers or anything similar?
Best Answer
There is no such thing as "the network" which behaves the same everywhere. The network is made of routers which simply forward packets unchanged. Then you have packet filter firewalls which might pass such packets unchanged, might block these if the reserved bits are set or might sanitize the packets by setting the reserved bits to zero. And then you have application level gateways/firewalls which effectively are an endpoint for the TCP connection and which create a new connection consisting of different packets and of course the reserved bits set to a sane value.
There are enough side channels how devices can communicate in a hidden way. This can be such reserved bits, timing or size of messages, application layer information like extra spaces or differentiating between upper and lower cases in text based protocols, steganographic techniques etc. Depending on the abilities of the devices of the network such side channel information will pass without changes, might be inadvertently removed or might be explicitly removed.