Every time you use software that interacts with a Bitcoin network, and especially a Bitcoin node, you leave a sticky fingerprint in your traffic. It comes in the form of a small, but unavoidable spike in volume every time a new block is mined and the nodes start gossiping about it.
Spike?
I leave my utorrent always on, I have a 20Mbit upload speed, that's enough to send 3 blocks per second.
Block timestamps are also quite random, you will need days of monitoring if somebody else is using the connection for browsing things and is turning the node offline shen he sleeps.
The blocks in Bitcoin are quite big, and the propagation speed is critical for consensus (greater delay means more frequent accidental forks), so such effect is predictable, and, in a sense, inherent to the Bitcoin architecture.
Same as above..
Now, since you mentioned ISP would be using this to detect bitcoin traffic.
Wouldn't they fare much better by running multiple clients and comparing the IP logs?
I mean, what's the chance of a user having a skype conversation with 20 people running a node?
Just asking!
LE:
And yeah, move it to a more suitable board, it will get drown in a sea of useless topics here.