OpenVPN is Open to VPN Fingerprinting: Appendix

Figure 11: Evaluation Process for Active Server Fingerprinting.

Figure 12: Decision tree derived from ISP and VPN datasets.

Table 4: Recommendation Websites Used

Table 5: Evaluation results on Merit, breakdown by configuration. Highlighted rows are “obfuscated” configurations. Variants marked with stars mean that the VPN provider does not disclose which obfuscation technique is used and we can only infer the variant type based on packet captures. Note Hide.me claims the tls-crypt option alone is enough to “obfuscate entire traffic” [18]. However, this option only encrypts control channel payloads but not the OpenVPN packer headers.