> You can look at additional measures, not just amplitude. Packet type, for example. Or components of TCP conversations Yes, I did that too. Had to analyze tra

> You can look at additional measures, not just amplitude. Packet type, for example. Or components of TCP conversations Yes, I did that too. Had to analyze traffic to QA a VPN app. > But Tor-specific parameters are buried in encrypted payloads, so amplitude is decent enough. Indeed it is. It's even possible to do traffic shape fingerprinting on that.