Sorry I caused you so much trouble!
You see, it was heavy to retrain from "spamming" while observing the nonspeeched articles (0 replicas!) which have been published some month (and even years) ago.
It looks as if all agree that it is quite adequate for SORMing just to collect the traffic filtered across separator:
<protocol ID> <IP address> <port number>
where <protocol ID> = 6(TCP)/17(UDP)
<IP address> = Service Provider's IP addresses
< port number>=20/21/25/69/80/110/115/119
And the only way to defend is encryption of Email messages - it is for ordinary people. As to riches - I saw the advice on your pages to employ Programmers for developing software based on IPsec specifications, but - it is for riches, very riches....
It seems to me, that there is no point to attract the FSB's attention by sending out of encrypted or funny corrupted letters - do not trouble trouble until trouble troubles you. After all, when OGPU-MGB could not read an intricate letter the only path for this letter was to rubbish bin...
The better way is, for example, just to write to each other the normal Email letters about sport, weather, drinking, girls and computer games. Of course, you can arrange the battle via Internet with your friend. A lot of computer games (Unreal, Quake Team Fortress, Quake 3: Arena, Half Life: Team Fortress Classic, ....) allow to have a dialog with your companion via Internet not worse than the famous ICQ. The more pleasant fact is that any game can use the ports numbered from 1023 and up to 64K as well as the game developers are not restricted by Request For Comments...
What else.... In general, it is not a great problem to detect a device fitted by FSB in backbone or trunk links, especially if a Service Provider did not want to "have" this one. The next step is to shoose a set of "stupid" methods for Process-to-Process communications. The great thing is only to keep a still tongue in your own head...
Regards,
Victor Angelov