Based on my observations alone, using sorts of TOR / VPN / Proxy configs, it feels to me as though they're matching entry point to exit point using the time domain... spurting packets of data in timed bursts, so that an entity with a whole-view of the internet can match 'drum beats' at the entry point and exit point.