philosecurity

Here’s how it works: First, you place a sensor on the network. Then, you identify packets at two different layers of communication: ie. SMTP traffic and simple UDP packets. You measure the minimum latency of each packet type. If the difference between the latencies is significant, then you know one set of packets is being processed more than the other. So, for example, unusually long SMTP latency compared to simple UDP packet latency might indicate that there is an SMTP content filter in your path.