*4.3. Architecture*

We conducted the experiment utilizing the following architecture for data capture and further investigation.

The architecture presented in Figure 6 comprises two endpoints: Alice (303) and Bob (311), who have established an RSTEG channel and are exchanging steganograms, among other network traffic. Bob's endpoint resides in a local network (310) in which all network traffic goes through the core router (312). The core router sends a copy of all traffic to the passive warden (313). Communication coming from other network devices (314) not necessarily involved in steganographic communication is also analyzed.

**Figure 6.** Implementation architecture.
