This appears to be a document that describes an NSA protocol: http://www.spiegel.de/media/media-35676.pdf Which might give some valuable clues as to what we should be doing! Only skimmed so far, but h/t to Adam Shostack who tweeted that we should look at the amount of random data stuffed into the packets. iang