Melon VPNWhat the network looks like in 2026, and how we measure it
A VPN is a bet about what the network will do next. That bet is only as good as the measurements behind it, so this is a plain account of what changed, what we watch, and what we think is coming.
Three things that changed
Deep packet inspection stopped being exotic. Equipment that reads past the packet header and inspects the payload is now standard in carrier and enterprise networks. It does not have to decrypt anything to be useful: handshake patterns, packet sizes and timing are enough to classify a flow. A protocol whose shape is fixed is a protocol that can be filtered.
Protocol fingerprints are catalogued. OpenVPN and WireGuard are well documented, and their handshakes are recognisable on the wire. That is not a flaw in either protocol — it is what happens to any widely deployed design. The practical consequence is that a service which can only speak one fixed shape is easy to identify, and identification is the step before blocking.
Certificate authorities became an attack surface. The eMudhra compromise in October 2026 was not a stolen website certificate. Eight intermediate CA keys had between 3 and 8 bits of entropy where 384 were required, which made them guessable. A guessable intermediate key lets someone mint a certificate your browser accepts for any domain. The chain of trust that makes HTTPS work is also a chain of parties that can fail.
How we measure it
None of the tools below is ours, and none of them answers every question. We use them because each one covers a different layer, and because a claim about the network should be checkable by someone who does not work here.
- OONI Probe — open source, runs on volunteer devices, tests whether specific websites are reachable from a given network. It measures reachability and reports it publicly. What it cannot tell you is why a site failed: a timeout and an injected reset look the same from the outside.
- RIPE Atlas — a global network of hardware probes that run ping, traceroute and DNS measurements on request. It shows where a path breaks and how routes differ by region. It measures infrastructure, not application-layer filtering.
- Cloudflare Radar — aggregated traffic volume, outages and routing anomalies across large parts of the internet. Useful for seeing a country-level event as it happens; by design it cannot show you a single user's connection.
- Censored Planet — academic remote measurement that infers filtering from the responses of public services. Broad coverage, but it lags events and depends on inference rather than direct observation.
- M-Lab — open platform for bandwidth, latency and route measurements. It is the reference we use for throughput claims, precisely because we cannot tune its results.
- Our own probes — we sample handshake latency and success rate from several regions against each route we sell, continuously. This is the only measurement that answers the question a user actually asks: is this particular route usable right now, from here.
The pattern across all six: the public tools show the shape of the problem, and the private probes show whether a specific route works today. Trusting either one alone produces confident, wrong conclusions — a mistake we have made, which is why the security pages on this site are written with dates and sources attached.
What we expect next
Encrypted Client Hello. ECH hides the server name in the TLS handshake, which removes the single most widely used filtering signal short of full interception. It also makes some forms of network troubleshooting harder, for network operators and for us. Both effects are real, and the second one is usually left out of the announcement.
Post-quantum key exchange. NIST standardised ML-KEM in 2024, and hybrid handshakes are already being deployed. The near-term risk is not a quantum computer arriving tomorrow; it is traffic recorded today being decrypted later. Handshakes that mix classical and post-quantum key exchange cost more bytes and a little more latency, and that trade is worth making now rather than after the fact.
Classification driven by machine learning. Rules written by hand are brittle; models trained on flow characteristics are not. The direction is clear enough that designing a protocol around a single fixed traffic shape is a dead end. This is why Melon-Link separates how a session is carried from what the session is: the carrier can change without shipping a new app to every user, and without the change being visible as a version number.
What we will not claim
A VPN reduces what a network operator can observe. It does not make you anonymous, it does not fix a compromised certificate authority, and it does not survive a device that already trusts a malicious root. Those are different problems with different fixes, and the industry's habit of blurring them is the reason so many people feel protected without being protected.