Encrypted Traffic Analysis

Encrypting network traffic protects message content but the timing of packets remains fully observable. An attacker monitoring an encrypted connection can measure inter-packet delays, connection duration, and the temporal pattern of bursts. These timing characteristics can reveal what type of application is in use, whether the user is typing or receiving data, and in some cases reconstruct sensitive information from timing alone.

Even without reading content, packet sizes convey information. A file download produces large packets near the maximum transmission unit; a chat message produces small packets. The total volume of data transferred in an encrypted session can reveal whether a large file was shared. Video call quality settings produce characteristic packet size distributions that are recognisable to a trained observer.

Traffic analysis examines who communicates with whom, when, how often, and for how long, without inspecting content. Even fully encrypted communications reveal a social graph. Knowing that a journalist contacts a specific government official's IP address at irregular intervals is valuable intelligence regardless of what was said. Traffic analysis has been used in surveillance since the era of telegraph communication.

When a browser establishes a TLS connection, it sends a Server Name Indication extension in the initial ClientHello message before encryption begins. SNI contains the domain name the client wants to connect to. Any observer on the network path can read the SNI and know exactly which website you are visiting, even though the subsequent HTTP requests are encrypted. SNI is in plaintext because the server needs it to select the correct certificate.

QUIC is a modern transport protocol developed by Google that runs over UDP. It encrypts the TLS handshake including the SNI from the very beginning using an Encrypted Client Hello (ECH) mechanism. ECH encrypts the inner ClientHello (containing the real hostname) inside an outer ClientHello addressed to a CDN entry point. This prevents hostname leakage that is unavoidable in classic TLS 1.3 over TCP.

Website fingerprinting attacks exploit the fact that each website produces a characteristic pattern of resource requests: a specific number of objects, of specific sizes, loaded in a specific order. By training a classifier on these patterns, an attacker can identify which website a user visited from the traffic patterns alone, even over an encrypted VPN. Research shows accuracy rates above 90 percent against common websites.

Tor routes traffic through three volunteer relays with encryption at each hop, hiding the connection between origin and destination. However, an adversary who can observe both the Tor entry node and the exit node can use traffic correlation: the timing and volume patterns at entry and exit match up even though the content is encrypted. Nation-state adversaries with surveillance capability on large portions of the internet can perform this correlation attack.

Netflix and YouTube adapt video quality to available bandwidth, and different resolutions produce different packet rate and size distributions. Researchers have demonstrated that an observer can infer the video title being streamed by matching the observed traffic pattern against a fingerprint database of known videos at different quality levels. This works even over HTTPS because content-length and timing patterns are visible.

A VPN encrypts traffic between the user and the VPN server, hiding destinations from the local ISP. However, the VPN provider sees all destinations, the total volume per destination is visible to the provider, and DNS queries before the VPN tunnel starts may still leak to the ISP. Additionally, WebRTC in browsers can expose the user's real IP address even when a VPN is active, unless explicitly blocked.

Before a TLS connection is established, the browser performs a DNS lookup to resolve the domain name to an IP address. If DNS is not encrypted (no DoH or DoT), the DNS query travels in plaintext and reveals the destination to the local resolver, the ISP, and any observer on the network. Even if the subsequent TLS connection is encrypted and ECH hides the SNI, the DNS query already disclosed the destination.

Defending against traffic analysis requires adding cover traffic to obscure real patterns, using anonymity networks with traffic shaping, and encrypting DNS with DoH or DoT. HTTPS padding can obscure object sizes. Tor with a pluggable transport obfuscates traffic patterns to resist censorship-based detection. No single countermeasure defeats all traffic analysis attacks; effective protection requires layering multiple techniques.

Which piece of metadata is visible to a network observer even when TLS 1.3 encrypts the HTTP request?

Encryption protects content but not metadata. Timing, packet sizes, and communication patterns reveal significant information. TLS SNI leaks the hostname in plaintext; QUIC's Encrypted Client Hello prevents this. Website fingerprinting can identify visited sites from traffic patterns. Tor is vulnerable to traffic correlation by global adversaries. DNS lookups before TLS reveal destinations unless DoH or DoT is used.