This is the exact problem solved by onion-routing. The first node is called "Guard" for a reason, it can directly monitor all incoming connection to the network, but if onion-routing is used and the system is properly designed, it usually doesn't matter. The only information revealed is the fact that someone has connected.