One of the documents from Guardian released yesterday mentioned evercookie in one of the bulleted lists. If this is more "request" level than packet level, that could be the method they are using - http://en.wikipedia.org/wiki/Evercookie