This paper addresses the problem of non-intrusive traffic analysis of anonymous Mobile Ad Hoc Networks (MANETs). The goal is to trace down the destination of a certain source node with the minimum dependency on the underlying network infrastructure. Specifically, it is assumed that nodes in the network do not participate in tracing, the eavesdropper is not allowed to tamper traffic, and both the payload and the packet headers are encrypted at every hop. To deal with these constraints, a timing-based approach is taken, which identifies potential destinations by estimating end-to-end flow rates based on node transmission activities. Furthermore, it is shown that as routes change due to node movement, the tracing method quickly converges to the true destination by exploring topology diversity. The proposed method is proved to be consistent under mild conditions and shown to perform well even in the presence of intersecting flows and chaff traffic.