I'm in a coffee shop in Maine, using a VPN whose physical location is in Berlin.

I know that my packets between Maine and Berlin are encrypted, so someone snooping on that coffee shop's wifi can't see what my packets say, or where the packets will go after Berlin.

But can they see that the packets are going to Berlin in the first place? (either the physical location, or the IP address)

My mental model of packets sending over the internet is not correct / sufficient to answer this. I imagine the encrypted packets as little locked boxes being physically launched from Maine to Berlin, which would imply that the destination does not have to be written on the outside of the box since the destination is implicitly set by the trajectory of the launch. On the other hand, the destination could be inferred by viewing the trajectory and calculating the destination.

But since I know that the "trajectory" is a made up thing as part of my abstraction, I know I can't reason about the actual packets based on that part of the abstraction, hence my question :D

If you have a better abstraction which COULD have been used to reason about my question, I would love to hear it!

  • 1
    yes. otherwise how would they get there – Ewan Sep 1 '17 at 16:26
  • 2
    The “launch” abstraction is wrong. Better think of each packet as a letter with the sender and destination address written on it. What a VPN does is putting the real letter into another (usually encrypted) envelope that is then sent from you to the VPN server as a normal letter, or from the VPN server to you. En route, many post offices will look at the address on the letter to see where it should be sent next, or may even try to open the envelope (but they can't do that when the contents are encrypted). – amon Sep 1 '17 at 16:36
  • 2
    How could the launch and trajectory model ever make sense when data is sent through countless pieces of networking equipment around the world? – whatsisname Sep 1 '17 at 20:26
  • Yes, this is why technologies such as TOR exist - to hide the destination address, and to hide your address from the server. – Mike Harris Sep 1 '17 at 23:21

VPN is a term covering a broad range of technologies some of which have existed for a long time, and a number of which have serious flaws. So, barring those flaws, and speaking in broad generalities:

A TCP/IP message or packet contains headers, some of which are addresses like on a part of a postcard, plus a payload like another part of a postcard (text and/or picture). Analogous to a postcard being visible to the whole mail system, the whole postcard is visible to the internet. (With the understanding that the internet is much less secure since it is basically a crowd-sourced mail delivery system.)

An HTTP packet in some sense is a TCP/IP packet whose TCP/IP payload contains additional HTTP headers (salutations, greetings, etc...) and yet another payload (which might be HTML or JSON, empty, image, and/or other). Traffic, including addresses, and payload content are visible to the internet — all of the postcard is visible.

When you use HTTPS, the TCP/IP payload is encrpyted, but the packet itself is not; it is a standard TCP/IP packet whose visible addressing information is used by internet routers along the way to deliver the packet to the receiver. Traffic, including addresses, are visible but the content (HTTP headers, HTML, JSON, empty, images and/or other) are encrypted. This is analogous to using an envelope: the outside addressing is visible, but the payload is inside the envelope.

When you use VPN, entire HTTP packets including TCP/IP headers are encrypted. They are then wrapped within (the payload of) another unencrypted TCP/IP packet. Traffic can be seen by the internet going between the client and one of the VPN provider's endpoints. The VPN provider will decrypt received packets, effectively unwrapping the outer layer and then further delivering the inner packet. The VPN provider can see the final destination addresses and content. This is analogous to putting a postcard inside an envelope; the envelope is opened by the VPN provider and the postcard is sent.

VPN and HTTPS can be combined so that the internet only sees traffic between client and VPN provider (their addresses are visible). Only the VPN provider sees the final destination within the private network, but not the actual content. And then only the final server sees the actual content. So, here you're putting a letter inside an envelope inside an envelope.


  • HTTP = postcard having address & message visible to all
  • HTTPS = letter having message inside envelope having address
  • VPN = postcard having address & message inside envelope having address
  • VPN + HTTPS = letter having message in envelope having address in envelope having address

To reiterate, there are lots of different technologies for VPN and the actual visibilities depend on which is being used. There are also orthogonal technologies, for achieving anonymity, like the TOR browser. These attempt to hide addresses (and content) from prying eyes using similar technologies, and redirection.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.