As per the question. If I am connected to a website, streaming content from my native IP and I then enable my VPN, what does the website see?
Since you asked specifically what the website will see, rather than any intermediary watching your network connection, we should think in terms of requests:
- Your old ("native") IP will disconnect any long-running requests, and stop making any new requests.
- Your new (VPN) IP will connect and start making requests.
On their own, those two events will be unconnected as far as the web server is concerned, however there may be various things which can be used to guess, with reasonable confidence, that they are related:
- A cookie may have been set for your browser to send with each request, and the old and new requests will send the same cookie.
- A client-side script (code running in your browser) may be feeding additional stateful data with the content requests, possibly stored in LocalStorage so that it will resume if you reload the page.
- The URLs for the content may have been dynamically generated for you, so any request to that URL is assumed to be the same user.
- The site may take a "fingerprint" of your browser - User Agent, detection of features and settings, etc - and recognise that before and after you connect to the VPN.
- The server could log where in the stream you had got to, and line up the first position the new IP requests (e.g. with the
RangeHTTP header) with the last position the old IP requested.
All of these things are technically information which you are providing to the website, and can be altered, spoofed, or removed; but doing so will not happen automatically in a standard browser.
Your old http session will end and a new one will start. If you haven't so much as switched to a new browser, the site will be able to very easily figure out that you're the same person, just coming from a different IP. This situation happens routinely when, for example, you switch from your home wifi to a mobile connection, so all sites are able to cope and recognize that you're the same user.
They see that the user Matt (identified by cookie 1234…) two seconds ago had IP address 22.214.171.124 but now has IP 126.96.36.199
(I am assuming you are streaming via http(s), and the streaming happens by downloading chunks on multiple http connections)
Presuming you are using VPN to hide your identity, you are putting yourself at risk as the likelihood of success is low. Depending on your VPN provider, they may be keeping logs, your ISP may be monitoring the traffic and logging it too.
If you are streaming live content, you will be seen by your ISP as receiving a continuous stream of packets from 1 or more IP addresses, which is revealing as it matches the time of the live event.
Even if you are not registered, the remote website may be attaching headers (auth tokens) to your requests for the content as a unique ID of a guest user, they may be writing to your browser's local storage and session storage or attach cookies to your requests.
Starting a new incognito window in Chrome starts with fresh browser cookies, local storage, etc.
What's inevitable is hiding the meta data about the traffic (usage amount, where it's coming from, etc.).
This article on Medium would be very helpful: What you’re revealing to your ISP, why a VPN isn’t enough, and ways to avoid leaking it
It depends how split tunneling is configured on your VPN. Your VPN may decide base on this configuration to send the Internet traffic via VPN tunnel or via your regular connection to the Internet.
If your traffic will go via regular connection then the website will not even see that you are connected to VPN. If your VPN is configured to route all request via VPN network then website will see that you are connected from different IP address, so the effect is similar to changing your network connection (like changing WiFi connection or connecting via mobile device). Your session stored in your browser can still be accessible.