In this paper, we consider the possibility of hidden data. Since today all network services rely on the basic protocols, the use of data transmission capacities are not taken into account, untestable and redundant fields may become a big problem. All of the modern data protocols have vulnerabilities. An attacker can use the reserved fields or field use undocumented way. Regarding the mechanism of the transfer and detection methods described gears. The work is of great practical interest for the implementation of systems to detect and prevent intrusions and data leaks in it, the authors use the mechanisms of transmission and detection of transfers with using comparative evaluation of the fields in the packet with the values that are recommended in the standard protocol.