Public Wi-Fi: what the network owner sees

Someone else's network in a café, a hotel or an airport sees more about you than people assume, and less than the internet likes to scare you with. So we took a packet capture and looked at what actually leaves the wire.

The news hook: 130,000 access points, and what that number really says

On 16 September 2026 the Russian tech site iXBT ran a headline saying that Rostelecom had launched 130,000 public Wi-Fi access points and taken a third of the market. As in our two previous articles, we went to the primary source — and the number changed on the way.

• The primary source is a company press release, not the news piece. “Rostelecom is the leader of the public Wi-Fi market in 2025” went out to outlets on 14 September 2026; the market data in it belongs to the research firm TMT Consulting. The 16 September piece retells that release.
• Not “launched”, but “under service”. The release says (translated by us): at the end of 2025 the group had almost 130,000 public Wi-Fi access points under service, excluding the state digital-divide programme. The number of points grew by 16 % over the year. So 130,000 is not what was built in a year — it is what was being served at the end of the year before last.
• “A third of the market” is about money, not points. The public Wi-Fi market in 2025 was 5.2 bn roubles (+8.4 % year on year), and the group's share was 34 % of revenue. How many points the others run is not in the release.
• We do not know what “a point” means here. Neither the release nor the reprints explain whether they counted devices, venues or contracts. That is why this article never says “130,000 cafés”: one venue can run five access points.

What matters to us in that release: public networks are many and there are more of them every year, and the company and the analysts explain part of that growth by mobile internet restrictions in Russian regions — businesses needed a fallback channel for tills and payments. Those are their words, not our conclusion. The question we answer ourselves is the next one: what can the owner of such a network see?

Why HTTPS does not hide the site name

The padlock in the address bar covers the contents: the page, the password, the messages, the card details. That is true, and we will not play it down to make a better story. But before the padlock clicks shut, your device says the site name out loud twice:

1. The name lookup. To open a site, your phone first asks what its address is. An ordinary lookup like that travels in plain text, and the name in it is visible to everyone on the path — first of all to whoever runs the network.
2. The first packet of the handshake. Then the encrypted session begins, and in its very first, not-yet-encrypted packet the browser tells the server which site it came for: hundreds of sites can live on one address, and without that the server would not know which certificate to present. The field is literally called the server name — SNI.

The picture is even: what you do on a site is not visible, where you went is. A list of names collected over an evening is already a portrait: a bank, a clinic, a classifieds site, a mailbox.

What we measured ourselves

Rather than retell other people's scare stories, we captured our own traffic. Here is exactly what was done — anyone with a server of their own can repeat it:

• When: 20 September 2026, at 03:27 and 03:29 our time (UTC+5).
• Where: our own work machine, captured on its own external interface. We did not connect to anybody else's access point and listened to no traffic but our own. An access point in a café carries exactly the same packets — that is what makes the comparison fair.
• With what: tcpdump with full packet size; the analysis is our own program that pulls names out of the lookup queries and the server-name field out of the first handshake packet.
• What we asked for: four names, each with the same two commands — www.avito.ru, mail.ru, mayaknetworks.com and online.sberbank.ru.
• Two passes: first directly, then the same four names from inside a live Mayak tunnel (the Netherlands line — a real one, not a test rig).

Pass one, no tunnel. A 6.1-second window, 1,101 packets captured. In them:

• 4 names out of 4 in the lookup queries — in plain text, one query per name;
• 4 names out of 4 in the first handshake packet — the same four, also in plain text.

Pass two, from inside the tunnel. Same four names, same commands. This time we listened WIDER than in the first pass: not only the traffic to our four sites, but everything the machine sent and received. A 29.7-second window, 5,446 packets. In them:

• names in lookup queries — 0;
• handshakes carrying a server name — 0;
• all that is visible is one flow to one address: 686 datagrams and 104,426 bytes from us, 1,375 datagrams and 1,891,791 bytes back to us.

What is visible with the tunnel on

Translated from numbers into plain words, the network owner sees a line like this: “a device is talking to one address over UDP, sent 104 kilobytes, received 1.9 megabytes.” That is all. Not one name, not one hint that mail, classifieds and a bank were inside.

That is how a VPN tunnel works: the site name, the name lookup and the handshake with the site all happen INSIDE the encrypted channel. What reaches the wire in someone else's network is only the outer envelopes — the address of our node and encrypted payload. More on how our connection is built and which paths it takes is in a separate article.

What a tunnel does not hide

This section is against our own interest, which is exactly why it is here. The same capture shows what stays in plain view:

• The fact that you are using a private network. One steady partner instead of dozens is noticeable. We never promised to hide that.
• The address of our node. It is in every packet, otherwise the packet would not arrive.
• Volume and timing. In our measurement — 1.9 megabytes in half a minute. From the volume one can guess that a person is watching video rather than reading mail, and it is visible when they do it.
• Anonymity does not come out of this. A tunnel hides names from someone else's network. That is not the same as total invisibility, and we do not promise that — here or on the front page.

What to do on someone else's network

1. Assume the names are visible. Not the contents — the names. If you would rather not have strangers learn about your clinic or your bank, that is the actual reason to turn the tunnel on.
2. Turn the secure connection on BEFORE you open anything that matters. The name leaves in the very first packet: open the page first and switch on after, and the name is already on the wire.
3. Never click through a certificate warning. It means somebody has stepped in between you and the site — and then it is no longer the name that is visible, but the contents.
4. Check that the tunnel actually came up before you count yourself protected — here is how to check in a minute.
5. Do not believe promises of total invisibility — ours or anyone else's. Look at what exactly is promised and what backs it up.

What we checked

• The figure from the news. On 20 September 2026 we opened the iXBT piece of 16 September and three reprints of the Rostelecom press release dated 14–15 September (one of them names the market-data source outright — TMT Consulting). The wordings “almost 130,000”, “at the end of 2025”, “excluding the digital-divide programme”, “+16 %”, “5.2 bn roubles” and “34 %” come from there; the Russian originals are translated by us.
• Our own traffic. Two captures, 20 September, 03:27 and 03:29 (UTC+5). Every number in “What we measured ourselves” comes from them and from nowhere else.
• The tunnel was real. The second pass went through a live line of our network, with a completed handshake and a verified exit address — not a test rig and not “in principle”.

What we do not know

We try to make sure nothing can be inferred from our text beyond what is in it.

• How a particular network in a particular café behaves. We measured on our own machine. What the owner of an access point records, and for how long they keep it, is up to them, and we did not measure that.
• The rules for signing in to public networks. Who has to identify themselves and how is a legal question; we did not verify it against primary sources, so we say nothing about it.
• How many public networks there really are. We know one number from one company's own release — and we do not know what exactly it counted.
• What happens to names next. There are ways to close both the name lookup and the server-name field; support for them is uneven, and we have no measurements of our own there yet.
• We do not retell other people's measurements. This article contains only what we caught ourselves and what the named publications say.

Short answers

Is public Wi-Fi dangerous? “Dangerous” is too big a word. What is checkable is this: the network owner sees the names of the sites you visit and does not see what you do there. How dangerous that is depends on what those names are.

Can the access point owner see my passwords? No, as long as the site uses HTTPS (the padlock in the address bar). The contents are closed. The site name is not.

What is SNI in plain words? It is a field in the first packet of an encrypted connection where the browser says “I have come to this site”. It is not encrypted yet — otherwise the server would not know which certificate to present.

Does private browsing help? No. It is about what stays in your browser, not about what leaves the wire. The network sees exactly the same thing.

What if I simply never open my bank on public Wi-Fi? The name leaves even when the site does not answer — that is literally what happened in our measurement. An open tab, or an app checking for updates by itself, is enough.

What is visible when the tunnel is on? By our capture — one address, one protocol and a volume: 104 KB sent, 1.9 MB received in half a minute. Names: zero.

So I am invisible? You are not. It is visible that you use a private network, the node address is visible, the volume is visible. We do not promise anonymity — we promise what we measured.

Is airport or metro Wi-Fi the same? The mechanics are the same, but we did not measure those particular networks and will not claim anything about them.

And my home router? It sees exactly as much — the names. The difference is whose router it is: at home it is yours, in a café it is not.