This sounds like you might need to define your threat model in a little more detail. I don't think the threat such that you might catch ME sending out data while you're looking for it in this way.

But let's say I was your attacker, I would simply encode some data in the timing between each individual packet that I am sending out on behalf of the kernel: imagine a sort of morse code where that are long pauses between packets for dashes and short pauses between dots.

So now all I have to do is convince your ISP to let me look at your packages timing.