Abstract This paper uses Traffic Analysis (TA) for identifying sources of tunneled video streaming traffic. The key idea is to examine encrypted and tunneled video streaming traffic at a Soft-Margin Firewall (SMFW) that is located near the streaming client in order to identify undesirable traffic sources and to block or throttle traffic from such sources. The key contribution of the paper is the design and experimental evaluation of a novel two-stage classifier for identifying specific video sources from heterogeneous background traffic within an encrypted tunnel. Being able to classify video sources in the presence of such traffic mixture can help the SMFW to successfully obfuscate or block undesired video browsing while allowing a user to receive traffic from legitimate applications running over the same encrypted tunnel. Using OpenVPN servers for creating encryption tunnels, experiments were conducted on a large number of popular video streaming sources with various combinations of feature extraction and data processing techniques to verify the effectiveness of the two-stage classifier. It was experimentally demonstrated that by using the proposed two-stage classifier, it is indeed possible to identify video streaming sources with high accuracy and low false-positive rates in the presence of non-video background traffic within an encrypted tunnel.