Comment by thadt

Good work. But - this is an implementation bug right? If the underlying stream of packets gives you a distinguisher (in this case, slightly larger packets), then this attack works. So adjusting the chaff and payload packet sizes to some fixed capacity restores obfuscation, if I'm understanding this correctly. And response packets - those also have to be managed to prevent leakage.