Encrypted does not
mean invisible.
The usual assumption is that encryption ends packet analysis. It ends payload inspection — which was never where most of the answers were.
Encryption conceals the contents of a session, not its existence, its shape or its outcome. Who talked to whom, when, for how long, how much in each direction, at what rate, how regularly, whether the handshake succeeded, which TLS version and cipher were negotiated, which server name was requested and which certificate was presented — all of it is observable without decrypting anything. Performance diagnosis and behavioural analysis run almost entirely on that metadata, which is why continuous capture keeps working on a network that is 95% encrypted.
Six things encryption does not hide.
The whole handshake
TLS negotiation happens in the clear before encryption starts. Version, cipher suites offered and chosen, the requested server name, the certificate presented and any alert raised are all readable.
This is why an expired certificate is a one-line finding in a capture and an afternoon of guesswork without one.
Timing, to the microsecond
Round-trip time, server response time and the gaps between request and response are properties of when packets arrived, not of what they contained.
The entire "network or application" question is answered from timestamps, and encryption is irrelevant to it.
Transport health
Retransmissions, zero windows, resets, failed connections and out-of-order segments are all TCP-layer events. TLS sits above them and does not obscure any of it.
Every cause on our retransmission page is diagnosable on fully encrypted traffic.
Volume and direction
How much moved, which way, and in what pattern over time. Encrypted payloads are still counted bytes with timestamps.
Egress analysis and top-talker ranking are unaffected by encryption.
The relationship graph
Which hosts talk to which, how often, at what hours, and whether the pairing is new. This is metadata about the conversation, not content within it.
The lateral-movement and beaconing signals are built entirely from this layer.
Regularity
A session opened at a consistent interval has a period whether or not anyone can read it. Human traffic is irregular; scheduled traffic is not.
Detectable over weeks of retained metadata without any payload access at all.
What genuinely is not visible
- The contents. Files, credentials, commands and queries inside the session are unreadable without decryption, and Net-Monitor does not decrypt.
- Application-layer detail above TLS. Specific HTTP paths, headers and parameters are inside the encrypted envelope. What remains is the server name from the handshake.
- Confirmation of what data left. You can establish that 300 MB went to an unfamiliar destination at 02:00; establishing what it was is an endpoint investigation.
- This is a real limit, and it is the right trade. Decrypting at scale means holding keys, terminating sessions and creating a target — which most organisations correctly decline. The metadata answers most of the questions anyway.
Short answers.
Can you analyse encrypted traffic without decrypting it?
Yes, for most purposes. The handshake is in the clear, and timing, volume, direction, transport health, peer relationships and regularity are all properties of the packets rather than their contents. Performance diagnosis works essentially unchanged, and behavioural analysis is built on exactly that metadata.
What is lost by not decrypting?
The contents: files, credentials, commands, queries, and application-layer detail such as HTTP paths and headers. You can establish that a transfer happened, to where, when and how large — but not what was in it. For most monitoring and a good deal of investigation, that is sufficient.
Should we decrypt TLS for monitoring?
It is a serious decision with real costs: key custody, session termination, added latency, privacy and legal exposure, and the creation of a high-value target. Many organisations decide against it. Because the metadata answers most operational questions, the trade is usually easier than it first appears.
Does TLS 1.3 change this?
It reduces what is visible in the handshake — notably the certificate is now encrypted, and encrypted client hello removes the server name where it is used. Timing, volume, direction, transport health and the relationship graph are unaffected, so the analysis this page describes continues to work.
Related questions.
Most of your traffic is encrypted. Most of the answers still are not in the payload.
We will run against your own encrypted traffic and show you what comes out of it.