You've turned on your VPN. The lock icon is glowing, your connection is secure, and websites are loading. It would seem your ISP no longer knows a thing about your online activities.
However, there's a catch: encryption hides the content of your data, not all the signs of its transmission.
Sometimes these signs are enough to figure out what technology you're using, and under certain conditions, even guess which websites you are visiting.
What Does an ISP See When a VPN is Running?
Typically, an ISP sees the VPN server's IP address, connection timestamps, the volume of transferred data, and network traffic characteristics.
However, they should not see the contents of the encrypted tunnel or the addresses of websites inside it, provided the VPN is properly configured and free of leaks.
The question arises: where does the ability to recognize activity come from?
The fact is that encrypted packets still have size, direction, and transmission timing.
For instance, a video streaming service creates one load pattern, a messenger another, and downloading a large file a third.
Modern analysis systems are capable of searching for patterns in such traffic streams.
How Does Encrypted Traffic Recognition Work?
Imagine you are watching a movie through a VPN.
Your ISP cannot see the movie itself. But they can observe that large volumes of data are regularly flowing through your connection.
If you are chatting in an instant messenger, the transmission profile might look quite different: short messages, small packets, pauses.
This doesn't allow for a definitive identification of the application just yet. Different programs can generate similar traffic.
However, researchers use machine learning to uncover more subtle patterns.
This approach is known as traffic fingerprinting.
Can a Specific Website Be Identified?
Sometimes, yes.
Research shows that under certain conditions, visited web pages can be recognized by the sizes and sequence of encrypted packets.
However, there is an important limitation.
In a laboratory setting, a system might know a predefined list of several hundred websites and select the closest match.
On the real internet, there are millions of websites. Background applications, updates, messengers, and other connections are running simultaneously.
Therefore, high accuracy in a laboratory experiment does not mean an ISP can identify every single page you visit.
Furthermore, an observer needs to capture the right segment of traffic. Not every point in the network allows for such analysis.
What Do DPI and VPN Blocking Have to Do With It?
DPI, or Deep Packet Inspection, is used to classify network traffic.
DPI equipment can take into account not only the server's address, but also the handshake characteristics of the connection, protocol specifics, and flow behavior.
This is precisely why a VPN sometimes fails to connect, even though the server itself is up and running.
However, it's important to distinguish between two different tasks here.
Recognizing a VPN tunnel and identifying a specific website inside it are two entirely different things.
The former can be significantly simpler. The latter requires advanced analysis and far from always yields reliable results.
What Can an Everyday User Do?
First and foremost, do not confuse encryption with complete invisibility.
A VPN remains a useful tool for protecting data in transit, but it does not guarantee absolute anonymity.
If privacy is your priority, keep a few things in mind:
- Use modern protocols and supported applications.
- Check whether DNS requests and other connections are leaking outside the tunnel.
- Do not rely on simply switching VPN servers as a universal defense against traffic analysis.
- Remember that logging into personal accounts, cookies, and on-site actions can still reveal your identity regardless of a VPN.
What Did Researchers Discover Recently?
In 2026, researchers explored the capabilities of HTTP/2 for altering the characteristics of web traffic that analysis systems rely on to recognize visited pages.
The idea is to make it harder to analyze data sizes, sequences, and transmission timing by leveraging the specific features of the protocol itself.
This is a promising direction, but it is not yet a universal defense that can be toggled on in any VPN with a single switch.
The Bottom Line
A VPN does not become useless simply because its traffic can be analyzed.
It still successfully protects the contents of your connection.
However, encrypting data and hiding the actual fact or pattern of its transmission are two different challenges.
It is the second challenge that network privacy researchers are tackling today.
Glass Bridge. Author's material on DPI, encrypted traffic analysis, and HTTP/2 research.