Encrypted tunnels have made analyzing Internet traffic harder, when a virtual private network is used the flows become intertwined and thus lose their unique characteristics. These characteristics which are analyzed by network middleboxes for, among other things security and quality-of-service purposes. Using a real-world dataset, this project investigates if packet size and inter-arrival time for the three-way handshake packets can be used to detect the beginning of TCP flows inside encrypted tunnels. Three classification methods were tested, the first using packet size values for detection, the second used correlation data between packet sizes for each three-way handshake packet and the last method used correlation data between packet sizes and inter-arrival times for each three-way handshake packet. The best results were obtained when with the first and last of these methods, with a specific set of parameters.