Theres no more right or wrong with vpn's as you can still work out what type of traffic is passing down the wire by the volume of encrypted traffic. YouTube tra

Theres no more right or wrong with vpn's as you can still work out what type of traffic is passing down the wire by the volume of encrypted traffic. YouTube traffic surges which gives you an idea they are watching YouTube, large file downloads like Linux distro's will be typically a continuous consistent level of traffic, webpages are short and brief. Googles services like DNS, api's etc are also joined up in realtime but DYOR. The NSA's Ghidra is a useful tool to start with and is superior to more expensive reverse engineering tools on offer.