From BOLT 08 we can see that every message is sent in the following way:
2 byte: length 16 byte: MAC [length] byte: Encrypted message 16 byte: MAC
In reality these messages will be send over TCP/IP on the internet. The ip header specifies the length of the data package that is being sent. If we extract the length and subtract 34 byte for the header plus the two MACs we would know how long the message is.
Is the idea to always send a 2^16 byte ip package and fill the rest with junk data? If yes why isn't that specified in the BOLTs? If no: why encrypting the length anyway?
I assume that an attacker would be able track all tcp/ip packages on the lightning port and would at least be able to deduct which messages are being sent even though the messages themselves are safe.
Assume the message length can indeed be deduced can't that be used together with the MAC to reconstruct the session key for that message?