Encrypted Traffic Analysis

Encrypting network traffic protects message content but the timing of packets remains fully observable. An attacker monitoring an encrypted connection can measure inter-packet delays, connection duration, and the temporal pattern of bursts. These timing characteristics can reveal what type of application is in use, whether the user is typing or receiving data, and in some cases reconstruct sensitive information from timing alone.

Even without reading content, packet sizes convey information. A file download produces large packets near the maximum transmission unit; a chat message produces small packets. The total volume of data transferred in an encrypted session can reveal whether a large file was shared. Video call quality settings produce characteristic packet size distributions that are recognisable to a trained observer.