The Speed Test That Lies to You
It's 8 p.m. on a Tuesday. Your speed test returns 200 Mbps, clean ping, zero packet loss. You tab over to your video call and watch it dissolve into a pixelated mess within thirty seconds. Or your streaming app buffers on cue every weeknight evening, reliable as a commute. Or a torrent that should have finished before lunch is still grinding away at midnight.
The speed test wasn't wrong. Your ISP just wasn't slowing everything. They were slowing something specific.
That distinction is the whole story.
Traffic shaping is the toolkit ISPs use to manage data flow selectively: by type, by destination, by time of day, without touching the headline number printed on your invoice. It's legal in most countries, buried somewhere in the terms of service you clicked through, and nearly invisible unless you know what to measure.
How a Packet Reveals More Than You Think
Every piece of data crossing the internet travels as packets, small chunks carrying a header that says where they came from, where they're going, and which protocol they're using. Your ISP's routers read those headers constantly. That part is just how the internet works.
The technique that makes targeted throttling possible is called Deep Packet Inspection, or DPI. Instead of just reading the address on the envelope, DPI opens it. The router examines the payload itself, identifying not just that traffic is headed to a specific IP address but that it's a Netflix stream, a BitTorrent handshake, or a VoIP call.
Once the router knows what it's handling, it applies a policy. Slow this. Prioritize that. The technical term for deliberately slowing a specific traffic class is rate limiting; sorting traffic into priority lanes is called Quality of Service, or QoS. Both can be used neutrally (keeping a hospital's video calls stable during peak hours) or commercially (making a competitor's streaming service buffer while your ISP's own branded service runs smooth).
Here's a scenario that's less hypothetical than it sounds. You're on a 300 Mbps plan. Your neighbor has the exact same plan from the exact same ISP. You both stream video from the same platform every evening. You use a VPN for work. She doesn't. Come 8 p.m., her picture is crisp; yours stutters like a slideshow. Why? Because DPI can't see inside encrypted VPN traffic, so the ISP can't confirm it's video and applies a blanket rule: unclassified encrypted traffic gets deprioritized during congestion windows. She gets shaped around. You get shaped down.
The Three Tools ISPs Actually Reach For
Throttling isn't one technique. It's a menu.
Rate limiting by protocol. BitTorrent has a distinctive handshake pattern that DPI identifies almost instantly. Many ISPs cap torrent traffic to a fraction of available bandwidth regardless of what's actually being downloaded, legal Linux distributions included. The user sees their client showing 200 KB/s on a connection capable of 20 MB/s and blames the tracker or the seeds. It's usually neither.
Destination-based throttling. Some ISPs throttle traffic to specific content providers, particularly during commercial disputes or at network interconnection points called peering exchanges. There's a well-documented case involving Netflix traffic degrading significantly for customers of several large American ISPs before Netflix paid for faster interconnect access. Speed tests to local servers stayed perfect the entire time. Only traffic to Netflix's servers slowed. The test and the experience told completely different stories, and most users just assumed Netflix was having a bad week.
Time-of-day shaping. Networks get congested in the evening. Rather than build capacity for peak demand, some ISPs apply blanket slowdowns to high-bandwidth traffic classes between roughly 7 p.m. and 11 p.m.: video streaming, large downloads, peer-to-peer transfers. If your downloads always feel faster at 2 a.m., this is almost certainly why.
What People Assume (and Why It Misleads Them)
The common assumption is that throttling means your whole connection slows and you notice immediately. That's not how modern traffic shaping works, and ISPs are counting on exactly that misunderstanding. Slowing everything generates complaints and churn. Slowing one protocol at one time of day is harder to attribute, harder to prove, and easy to wave off as "network congestion" or "server-side issues."
Calling customer support rarely helps. The representative running a diagnostic sees the same clean speed test you saw. Nothing looks wrong from their tools, because nothing is wrong with your connection in the way those tools are built to measure. It's a bit like going to a doctor who only checks your resting heart rate and concludes you're fine, right before you run a mile.
So how do you actually check? Tools like the Wehe app, developed by researchers at Northeastern University, are specifically designed to detect protocol-level throttling by sending traffic that mimics different apps and comparing the speeds. It's not perfect. But if Wehe shows your video traffic running at 8 Mbps while a generic data stream runs at 45 Mbps on the same connection at the same moment, you have something concrete to work with.
A VPN changes the picture too, and not always the way people expect. Encrypting your traffic can prevent DPI from classifying it, which sometimes improves speeds for throttled protocols. But it can also trigger the "unclassified traffic" penalty, or hit a separate cap on encrypted transfers entirely. Whether a VPN helps depends on which shaping policy your ISP is actually running, and you won't know until you test both ways.
The Recourse You Actually Have
Regulatory pressure matters here more than any technical workaround. Net neutrality rules, where they exist, restrict ISPs from throttling legal content based on its source or type. Where those rules have been weakened or repealed, ISPs have considerably more latitude. Your national regulator's current stance is worth a five-minute search.
Practically, running multiple diagnostic tools across different times of day builds a picture that a single speed test never will. Document the pattern: same app, same time slot, same degraded performance, day after day. That's the kind of evidence that means something when you escalate a complaint, switch providers, or want to make a case to a regulator.
Are ISPs necessarily acting in bad faith? No. Networks are genuinely congested, and some shaping is legitimate traffic management. But the line between managing a network and managing competition is thinner than their marketing suggests. The only way to know which side of it you're on is to measure the things they'd rather you didn't bother measuring.