If traffic is encrypted, and there is constant other traffic to same server, then it might be hard to identify.