Blind techniques to detect network applications---approaches that do not consider packet contents---are increasingly desirable because they have fewer legal and privacy concerns, and they can be robust to application changes and intentional cloaking. This body of work asserts that passive methods enable network reconnaissance without the need for deep-packet inspection. We demonstrate the validity of our assertion by first demonstrating the effectiveness of passive techniques and then presenting two separate passive techniques which aid in network reconnaissance. |