Among many other methods (such as the deep packet inspection devices that have been common for quite a while), one particularly easy attack would be checking th

Among many other methods (such as the deep packet inspection devices that have been common for quite a while), one particularly easy attack would be checking the TCP initial sequence numbers for changes in randomness[1]. Similarly, port number and usage can also be an easy tell when you see sockets opening on a pattern like this over time: [ ..., 15001, 15002, 15005, 9004, 9005, 15006, 9006, ...] Often IPmasq/NAT doesn't help either, as it can exhibit its own distinct pattern of port/etc usage often due to how router maintains its statefulness. [1] http://lcamtuf.coredump.cx/newtcp/ http://lcamtuf.coredump.cx/newtcp/ At least we're improving with more randomness - the old version this paper ( http://lcamtuf.coredump.cx/oldtcp/tcpseq.html http://lcamtuf.coredump.cx/oldtcp/tcpseq.html ) shows how bad it used to be, with some vendors exhibiting very reliably non-random patterns.