First filed in 2005, the NSA (National Security Agency) has been granted a patent for techniques used to detect unwanted entities snooping traffic on the Internet. At its heart, the NSA looks for unnatural lag in the network at various levels. The lag could exist between different OSI layers or be exhibited as a slight time difference in packet traversal between known hosts. It's not the first time such an idea has been used to detect anomalous network activity, in 1999 l0pht released Anti-Sniff, a tool detecting ethernet lag as a result of cards operating in promiscuous mode