So-called covert channels can involve DNS, ICMP, packet transmission timing, even processor responsiveness (think of communicating morse code using the timings

So-called covert channels can involve DNS, ICMP, packet transmission timing, even processor responsiveness (think of communicating morse code using the timings of a program that switches between a compute-loop and idle, as observed from another program on the system), and any number of other techniques. Here's a very quick presentation on DNS channels and DNS tunnels from a few years back: http://www.loria.fr/~lnussbau/files/tuns-sec09-slides.pdf http://www.loria.fr/~lnussbau/files/tuns-sec09-slides.pdf A key question with controlling any of these sorts of channels is not necessarily blocking them, but limiting the bandwidth of the channels.