A packet capture contains encrypted application sessions. Which claim can normally be made without decryption, assuming the headers are visible?

1. The user's password is proven to be weak
2. The complete application message body is readable by default
3. All security analysis is impossible
4. Connection endpoints and transport timing can still be analyzed