What Your ISP Sees on Every Connection You Make
Without a VPN, your ISP has near-complete visibility into your internet activity. Every DNS query your devices make passes through the ISP's resolvers by default, revealing every domain name you visit. Every unencrypted HTTP request is fully readable. Even encrypted HTTPS connections reveal the destination IP address and the Server Name Indication (SNI) field in the TLS handshake, which often discloses the domain name. Your ISP can see not just that you visited a particular server's IP address, but which specific hostname you connected to, how long you stayed connected, and how much data you transferred.
In many countries, ISPs are legally permitted to retain this metadata and sell it to advertisers or provide it to government agencies. In the United States, the FCC rules that previously restricted ISP data collection and sale were repealed in 2017, leaving ISPs free to monetize browsing data. In the EU, data retention laws vary by member state. This is the reality that VPNs are designed to address.
Understanding exactly what a VPN hides — and what it does not — requires looking at what your ISP sees at the transport layer, not just at the application layer.
How a VPN Changes What Your ISP Sees
A VPN works by establishing an encrypted tunnel from your device to a VPN server. All internet-bound traffic from your device is first encrypted and encapsulated before leaving your network interface. Your ISP sees the encrypted tunnel traffic, not the original packets inside it.
From your ISP's perspective, a VPN connection looks like a single persistent connection to one IP address — the VPN server. The content of that connection is encrypted with protocols like AES-256-GCM (used by OpenVPN and WireGuard) or ChaCha20-Poly1305 (WireGuard's preferred cipher). Breaking this encryption is computationally infeasible for any organization, including ISPs, without the session keys — which the VPN server and your device negotiate privately using asymmetric cryptography during the handshake.
Inside that encrypted tunnel, your DNS queries go to the VPN provider's DNS resolver (or a third-party resolver of your choosing), your HTTP requests go to their destinations, and your TLS sessions are established from the VPN server's IP. The ISP sees none of this inner traffic — only the encrypted outer tunnel.
What Your ISP Can Still See When You Use a VPN
The VPN server's IP address. Your ISP can see which IP address your encrypted connection terminates at. By checking public IP blacklists, VPN provider databases, and BGP routing data, they can often identify that this IP belongs to a VPN provider. This is significant in countries where VPN use is restricted or monitored.
Connection timestamps. Your ISP's logs show exactly when you connected to the VPN and when you disconnected. This metadata is retained regardless of VPN use. Correlation of VPN connection times with external events is a real investigative technique used in traffic analysis.
Data volume. Your ISP can measure how many bytes pass through the tunnel. They cannot see what the bytes are, but volume can be correlated with activity types. A sustained 20 Mbps transfer over six hours suggests large file downloading. Bursty traffic patterns suggest normal browsing. This is crude, but it is still metadata.
Protocol fingerprint. Many VPN protocols have recognizable characteristics. OpenVPN's default port is 1194 UDP. WireGuard uses UDP on port 51820 by default. L2TP/IPsec uses UDP 500 and 4500. An ISP running Deep Packet Inspection (DPI) can identify VPN protocols even without decrypting them, based on packet timing, size distribution, and protocol-specific header patterns.
What Your ISP Cannot See When You Use a VPN
The websites you visit. With VPN active, DNS queries go through the encrypted tunnel. The ISP sees only tunnel traffic to the VPN server, not the domain names being resolved. Every HTTP request and the SNI of every TLS connection is inside the encrypted tunnel, invisible to the ISP.
The content of your traffic. The ISP sees encrypted bytes. They cannot read your messages, your search queries, your account credentials, or the files you download. There is no computationally feasible method for an ISP to decrypt AES-256-GCM traffic without the session keys.
Your browsing history and session duration on individual sites. Without VPN, timing analysis of DNS queries and connection durations gives the ISP a fairly accurate picture of which sites you spend time on. With VPN, all of that is inside the tunnel.
Which streaming service, game, or application you are using. Service identification relies on destination IP addresses and domain names. Both are hidden inside the VPN tunnel.
VPN Protocol Comparison
| Protocol | Encryption | Default Port | Speed | ISP Detectability | Obfuscation Support |
|---|---|---|---|---|---|
| WireGuard | ChaCha20-Poly1305 | UDP 51820 | Very fast | Moderate (UDP pattern) | Limited natively |
| OpenVPN (UDP) | AES-256-GCM | UDP 1194 | Fast | Moderate | Yes (obfs4, Shadowsocks) |
| OpenVPN (TCP) | AES-256-GCM | TCP 443 | Moderate | Low (looks like HTTPS) | Yes |
| IKEv2/IPsec | AES-256-GCM | UDP 500/4500 | Fast | High (known UDP ports) | Limited |
| L2TP/IPsec | AES-256 | UDP 500/4500/1701 | Moderate | High | No |
| PPTP | MPPE (weak) | TCP 1723 | Fast | High | No |
| Shadowsocks | AES-256-GCM or ChaCha20 | Configurable | Fast | Very low (proxy traffic) | Designed for obfuscation |
DNS Leaks: The VPN Blind Spot
A DNS leak occurs when your device's DNS queries bypass the VPN tunnel and go directly to the ISP's DNS resolver, even while VPN is active. This exposes your browsing destinations to your ISP despite the VPN protecting the rest of your traffic. DNS leaks happen due to OS-level DNS handling quirks, split-tunnel configurations, IPv6 DNS queries bypassing an IPv4-only VPN tunnel, or VPN client bugs.
To test for DNS leaks, visit a DNS leak test tool and check whether the DNS server shown is your VPN provider's resolver or your ISP's. If your ISP's resolver appears, you have a leak. Fixes include forcing the VPN client to use its own DNS, configuring the OS DNS settings to use the VPN's DNS server, and ensuring the VPN client handles IPv6 DNS queries if you have an IPv6 connection.
Traffic Correlation Attacks
A sophisticated adversary — typically a nation-state intelligence agency rather than a commercial ISP — can sometimes correlate VPN traffic even without decrypting it. If the adversary can observe both your connection to the VPN server and the VPN server's traffic leaving toward a destination, they can use timing and volume correlation to infer that your session corresponds to a specific outbound connection. This requires access to network infrastructure at both ends, which is why this threat is primarily relevant for activists, journalists, and others in adversarial environments, not for ordinary VPN users protecting against commercial ISP tracking.
Common Misconceptions
A VPN makes you completely anonymous
A VPN hides your traffic from your ISP and changes the IP address seen by external services. It does not prevent the VPN provider itself from logging your activity. It does not prevent tracking via browser cookies, fingerprinting, or account logins. It does not hide your identity from services you are already logged into. A VPN is one layer of privacy, not a complete anonymity solution. For stronger anonymity, Tor routes traffic through multiple hops, preventing even the VPN operator from knowing your full activity.
ISPs cannot detect VPN usage
ISPs can definitively detect most VPN protocols using Deep Packet Inspection. WireGuard, OpenVPN, and IKEv2/IPsec all have recognizable characteristics. The only reliable way to make VPN traffic undetectable is obfuscation — either using OpenVPN over TCP on port 443 (which looks like HTTPS), Shadowsocks, or obfsproxy-based bridges. Premium VPN services offer obfuscated server modes for this purpose.
A free VPN is just as private as a paid one
Free VPN services must monetize their infrastructure costs somehow. Many do so by logging user activity and selling it to advertisers — which is precisely the behavior users are trying to avoid. Free VPNs have also been caught injecting advertising, leaking DNS queries, and using weaker encryption. Independent audits of VPN providers' no-log claims are available for several reputable paid services; free services rarely undergo such scrutiny.
Using a VPN at home protects you from all government surveillance
A VPN hides your traffic from your ISP. If the VPN provider is in a jurisdiction with data retention laws, or if it operates under a legal system that can compel log disclosure, a court order to the VPN provider is the same legal pathway that would otherwise be a court order to your ISP. VPN providers in privacy-favorable jurisdictions with audited no-log policies provide the strongest protection, but no VPN is immune to legal processes directed at the provider itself.
Pro Tips
- Test for DNS leaks immediately after connecting to your VPN using a dedicated DNS leak test tool. A leaking DNS configuration defeats the primary privacy benefit of the VPN.
- If you need to bypass VPN detection (in a restrictive network or country), use your VPN's obfuscated server mode or configure OpenVPN over TCP on port 443, which is indistinguishable from regular HTTPS traffic to ISP-level inspection.
- Enable the kill switch in your VPN client. If the VPN tunnel drops unexpectedly, a kill switch blocks all internet traffic until the tunnel reconnects, preventing accidental exposure of your real IP and traffic to your ISP.
- Use WireGuard if your VPN client supports it. Its modern cryptographic design and lean codebase make it faster than OpenVPN and easier to audit for security. The tradeoff is that its static port is more easily fingerprinted.
- Verify that your VPN provider routes IPv6 through the tunnel if your connection has IPv6. An IPv4-only VPN tunnel leaves IPv6 traffic flowing directly to your ISP, creating a complete bypass of the privacy layer for all IPv6 destinations.
- Split tunneling — routing only some apps through the VPN — exposes non-tunneled traffic to your ISP. Be explicit about which traffic you want protected and which you are comfortable leaving exposed.
A properly configured VPN is highly effective at preventing your ISP from seeing your browsing destinations and content. The metadata — connection time, server IP, volume — remains visible, but the actionable browsing data is protected. Check what your ISP can currently see about your connection.