I would say that depends on how intensely you are being watched. Traffic analysis and timestamp correlation are a powerful tool. Small traffic bursts going out

I would say that depends on how intensely you are being watched. Traffic analysis and timestamp correlation are a powerful tool. Small traffic bursts going out, slightly larger ones coming in: surfing, reading the front page. (Or new post page.) Small traffic burst going out, lots of traffic coming in: loading an active topic thread page. Slightly bigger traffic burst going out, lots of traffic coming back in: posting a comment to an active, non-trivial thread. Number of packets (and total outgoing bytes) are useful for bucketing the size of the comment posted. Short comments should fit into a single payload packet. Longer comments obviously have their payload split across multiple packets, and by counting the total bytes sent, you have a decent estimate to the size of the comment posted. Combine comment timestamps with their lengths and you can infer quite a bit.