The connection is encrypted, the ISP can't see request headers. For the main data download, all they can determine is its an TLS connection to a netflix conte

The connection is encrypted, the ISP can't see request headers. For the main data download, all they can determine is its an TLS connection to a netflix content server. Potentially you could do some stateful monitoring looking for recent requests to fast.com but it's generally much harder to implement than simple IP or SNI based profiling.