Definition
Deep Packet Inspection is the practice of examining the full contents of network packets in transit, beyond the basic source and destination addresses that ordinary routers use. DPI systems can identify the application protocol in use (HTTP, BitTorrent, OpenVPN, video streaming, gaming), match payloads against signature databases, and apply policy decisions in real time — slowing some traffic, blocking other traffic, or simply logging what passes through.
How DPI Detects VPNs
Even though VPN traffic is encrypted, the encryption itself has a recognizable shape. The handshake, packet sizes, timing, and destination ports all carry tell-tale signs. OpenVPN over UDP on port 1194 is trivially identifiable. Even OpenVPN tunnelled over TCP 443 (which looks superficially like HTTPS) has subtle differences from real TLS-wrapped browser traffic that modern DPI can spot. WireGuard packets have a fixed structure that DPI can fingerprint within milliseconds.
How VPNs Counter It
The countermeasure is obfuscation, also called Anti-DPI: deliberately reshaping VPN traffic so it no longer matches any known signature. Common techniques include wrapping the VPN in a TLS tunnel (Stunnel), randomizing the handshake (XOR patches, obfsproxy, obfs4), making traffic mimic real browser sessions, or building entirely new transport layers (Shadowsocks, V2Ray, Hysteria). Where DPI is the principal censorship tool, the VPN industry's arms race against it never quite ends.