Globalization and the aftermath of Covid-19 saw an increasing number of people working from home, using their company’s VPN to access various internal resources hosted on enterprise servers. Similarly, VPNs have experienced more widespread use among the general public in recent years as a result of a growing understanding of digital privacy. While previous research has shown that VPNs are vulnerable to fingerprinting, our hypothesis is that attackers can discern even more precise information about VPN traffic. Specifically, because the VPN server and endpoint are hosted physically close in the business use case but not in the internet browsing case, an attacker can exploit the Round Trip Time (RTT) difference to distinguish between the two scenarios.

To compute the RTT of an encrypted VPN connection, we devise a method to identify underlying request-response packet pairs. We target TLS handshakes, using the fact that the order and size of their constituent packets remain unaffected by encryption and consistent among most connections. The latency is computed by subtracting the arrival times of the identified handshake packets. Applying our method on synthetic data, we find that the mean and median RTT of a business-use VPN are lower than those of a private-use VPN, implying an attacker can differentiate between the two scenarios by simply observing encrypted data.

IPv6 fragmentation remains a subtle yet impactful security concern in modern high-throughput, low-latency networks, where packet inspection is constrained by performance requirements and out-of-path monitoring architectures. This thesis investigates how discrepancies in IPv6 fragment reassembly behaviour between passive Intrusion Detection Systems (IDS) and endpoint hosts can lead to detection gaps, misinterpretation, and even exploitable evasion opportunities. Using a permutation-based testing model inspired by prior work, the study evaluates 720 overlapping fragment sequences across multiple operating systems and analyses the detection behaviour of Suricata deployed inside a 5G-simulated User Plane Function. The results reveal inconsistencies in reassembly policies, particularly under retransmission conditions, and demonstrate that alerts are not always semantically aligned with the payload seen by the host. A proof-of-concept exfiltration attack further illustrates how timing-based fragment delivery can bypass IDS inspection while reconstructing sensitive data at an attacker-controlled receiver. To mitigate these risks, the thesis proposes temporal IP ID tracking, overlap enforcement, and targeted traffic normalisation, especially in programmable or inline network functions. These findings highlight fragmentation as a persistent and under-addressed attack surface and call for more context-aware, timing-resilient detection strategies in next-generation networks.