Does Encrypted Client Hello blind network monitoring?

Partly. With ECH, a sensor no longer sees the real server name in the handshake, so name-based rules, web filters and simple shadow-IT lists lose precision for the sites that use it. What remains is a lot: the destination IP address and who operates it, the outer public name, usually that of a large content-delivery network, DNS answers when DNS is not encrypted end to end, the timing, volume and direction of every flow, and the client fingerprint. Behavioural detections such as beaconing, scanning, lateral movement and unusual uploads do not depend on the server name and keep working. Internal traffic is rarely affected, because internal servers seldom publish ECH keys. For managed devices you can influence it: point them at your own DNS resolver and use the browser's enterprise policies, which can control ECH and encrypted DNS. Name-based visibility of AI or file-sharing services from any network sensor, NetSenX included, becomes less complete for sites behind ECH.

← All 40 questions on Encryption and encrypted trafficAll topics