Decoy Traffic is a VPN connection mode that generates additional, artificial Internet traffic to make a user’s online activity harder to distinguish from other network activity.
Why Decoy Traffic Is Used
This mode can provide an additional layer of privacy when using Internet resources. In addition to encrypting the user’s regular traffic, Decoy Traffic generates extra data transfers that are not associated with the user’s actual online activity.
When you use a VPN, the data packets sent to and received from your device are encrypted. As a result, a network administrator, Internet service provider, or other third party monitoring the connection cannot normally see which websites you visit or which online resources you use. However, encryption does not necessarily hide the volume and timing of data transferred by your device.
Example
Suppose you occasionally publish images or videos on a messenger or social network that attract unwanted attention from the authorities in your country, and they want to identify you. The process could work as follows:
- On August 9 at 8:34 PM, you use a VPN to publish a video on Telegram. The video is 40 MB in size.
- The following day, investigators approach your Internet service provider and request information about which subscribers had a spike in outbound traffic of approximately 40 MB at 8:34 PM on August 9.
- On August 10 at 10:30 PM, you publish another 34 MB video on Telegram. On August 11 at 3:51 PM, you publish another video measuring 72 MB.
- A few days later, investigators request two more sets of data from the provider: which subscribers experienced a traffic spike of approximately 34 MB at the relevant time on August 10, and which subscribers had a spike of approximately 72 MB on August 11.
- After comparing the records, investigators discover that only one subscriber experienced traffic spikes corresponding to 40 MB, 34 MB, and 72 MB at all three points in time. That subscriber is you.
In practice, identifying a particular user may require matching traffic patterns across more than three points in time. Nevertheless, this type of traffic analysis can be used to narrow down and potentially identify the subscriber associated with a particular pattern of data transfers.
How Decoy Traffic Works
Decoy Traffic continuously generates additional amounts of artificial traffic between your device and the VPN server, creating numerous traffic spikes. This produces a persistent stream of network noise in which genuine transfers, such as uploading a video, are mixed with artificial ones. To an observer monitoring the connection, the genuine and decoy traffic can therefore become more difficult to distinguish based solely on their volume and timing.
In some implementations, Decoy Traffic can also deliberately limit the speed of the connection. As a result, uploading a video may take considerably longer than the available 4G or 5G connection would normally require. This reduces the size of individual traffic spikes and can make a file transfer resemble a video call or another bandwidth-intensive activity.
Warning
Decoy Traffic can generate a large amount of additional data. This may significantly increase the amount of mobile or other metered Internet data consumed by your connection.
How to Enable Decoy Traffic
The feature must be supported by your VPN provider. If available, it can typically be enabled in the settings of the VPN application or client.