If someone sniffs requests coming from my computer and my VPN's computer, there's no point using VPN, right? Because they can see the time when I made a request to my VPN and they can analyze all of the requests coming from VPN at the specific timeframe and they can guess which request was made by me, correct? That's just theoretically.

3 Answers 3


I am going to interpret your question as meaning the attacker can see network traffic from your computer and the from the VPN endpoint.

It depends what you are protecting against.

Generally, the term VPN is used to refer to an encrypted communication channel across an open medium such as the Internet, so if you want to hide the information being communicated, then a VPN is a very good way to protect yourself. Encryption helps this information remain confidential.

If you want to hide the fact that you are communicating, then this won't necessarily help so much, as an attacker with the network visibility you describe can cross-reference requests and responses.

However, if the attacker actually has access to your computer - then you have far bigger problems, as all your communications and data can potentially be viewed, compromised or destroyed.


As Rory Alsop notes, you're not anonymous to adversaries who see traffic entering and leaving the VPN service, because they can correlate requests from your computer with responses from the Internet site that you're accessing. However, you can mitigate that risk by using a VPN service in another country, and by choosing one whose government is less likely to cooperate with your country's government. And you can mitigate it further by using nested chains of such VPNs. But none of that will help against global adversaries. Against them, your only hope is adding Tor to the mix.

  • Tor is just as vulnerable to traffic correlation attacks as VPNs. This paper describes details.
    – Philipp
    Jan 15, 2014 at 9:30

As both @Rory Alsop and @mirimir wrote it is very difficult to hide what's going on when a VPN is used in this way.

Seeing both cleartext and ciphertext entering and leaving a VPN concentrator will most definitely reveal not only WHO is communicating but also WHAT is being sent. Using a very busy VPN box will mitigate the problem somewhat, the same way that Tor will mitigate the problem somewhat by mixing your data with a lot of other users, as long as the adversary hasn't deployed rouge Tor exit nodes that happens to relay your data.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .