[runjake]

And that's assuming the traffic is being subjected to the statistical analysis required for detection.

Timing also plays a big role. Many times a piece of intelligence is only useful for a duration of x.

Narus boxes are not magic, they can only do so much ;).

[tptacek]

I wrote this comment only to make it clear that the stats required to figure out if something is "really" encrypted are trivial. They take significantly less than a second for a Ruby program to perform. You'd just always run them.

Sorry I wasn't more explicit (or if you already realized that).