Neat little experiment! Delays between packets are not normally logged, so detecting this would be a challenge - any ideas of the best way to detect this sort of channel?<p>Interesting side note: If I recall correctly, a variant of this can be used to de-anonymise Tor connections if you have visibility over the entry and exit connections. Measure time and size relationships between packets and look for corresponding matching ones at the other end. Not 100% accurate, but with lots of connections it builds in confidence.