What Is Deep Packet Inspection?

Deep packet inspection is the practice of reading the content and structure of packets to classify them. Routing decisions normally need only addresses; DPI needs to look at what is actually inside, and that is the whole difference.

It is a legitimate network tool for traffic management, malware detection and quality of service, and it is also the most capable and most expensive censorship technique. Understanding what it can and cannot see is the difference between a tunnel that works and one that does not.

Short answer#

Encrypted traffic is opaque in content but not in shape. The sizes, directions and timing of your packets still describe the application running over them, and that description is what DPI classifies on.

So DPI cannot read your messages. It does not need to. It can work out which tool produced the stream, block it, and in some cases work out who is using it.

What DPI looks at#

Traditional routing checks where a packet is going. DPI examines:

• Payload structure — byte patterns, protocol signatures, and the header layout of the application protocol
• Packet size distribution — how large each packet is, and how that differs between application types
• Inter-arrival timing — how long packets take to arrive, and the rhythm of bursts
• Direction and volume — how much flows each way, and when it stops
• Quic, TLS and other record framing — the outer shape imposed by the transport in use

The payload items matter most for plaintext and poorly designed protocols. For a modern encrypted tunnel, the last three do the work, and they work surprisingly well.

What it has actually managed to do#

The evidence here is unusually good, because researchers have been able to measure it directly rather than infer it.

An encrypted proxy tool was identified from its first packet. Research presented at the ACM Internet Measurement Conference in 2020 investigated how a national filtering system detected and blocked Shadowsocks, a widely used encrypted proxy. The finding was that the filter used the length and entropy of the first data packet in each connection to identify probable proxy traffic, and once suspicious, followed up by sending the connection to a set of probes. No decryption, no payload access, no deep analysis of the stream.

An ordinary commercial VPN was fingerprinted. A 2024 paper in Communications of the ACM, “OpenVPN is Open to VPN Fingerprinting”, showed that OpenVPN traffic is statistically distinguishable. The general result matters more than the specific protocol: encrypted VPN traffic can be classified, and a classifier trained on one protocol’s characteristics does not need any access to the contents.

Encrypted QUIC is not a hiding place either. Work presented at USENIX Security in 2025 found that a national filtering system decrypts QUIC Initial packets at scale, applies heuristic filtering rules, and maintains a blocklist distinct from its other censorship mechanisms. This is notable because QUIC Initial packets are the part that is not supposed to be secret: the point is that the system is sophisticated enough to work with only what is legitimately visible, and to do it at volume.

The filter is then followed by probes. A 2015 IMC study described a layered process: passively notice suspicious traffic, then actively connect to the server behind it and check what it does. Its researchers found the probing systems appeared to be distinct from the main censorship infrastructure, and that blocking happened by address and port combination rather than by address alone, a detail that matters enormously to anyone rotating servers.

Why shape is so informative#

Encryption hides what you said. It cannot hide how much you said, when, or in what unit sizes, because those are properties of the transport and the network has to route it.

Concrete consequences:

• A file transfer sends long, evenly sized streams. Interactive traffic sends many small packets with pauses. The two are trivially distinguishable.
• Traffic that arrives and then goes silent for long periods has a different signature from a video stream.
• The very first packet of a connection often leaks the protocol, because protocol headers have characteristic sizes. This is precisely what the Shadowsocks measurement exploited.
• Patterns repeat. A classifier does not need to solve a single connection; it can recognise the recurring shape of a tool over hundreds of connections.

None of this requires breaking the cryptography. That is the part worth internalising: the attack surface here is not the cipher.

What DPI does not do#

• It does not read your content. Traffic protected by a correctly implemented TLS 1.3 connection is not readable by a network observer. DPI at the payload layer sees ciphertext.
• It does not work offline. Classification is statistical. A careful operator can make traffic look ordinary, and can change it when the classifier is retrained. That is a real defence, and it is why censorship resistance is an ongoing project rather than a solved problem.
• It is not one system. “DPI” describes a technique, deployed with wildly different sophistication. A small operator and a national one are not playing the same game.

Why this is where protocol design began to matter#

If you cannot hide the content, you can still work on the shape. That is the reasoning behind everything in the family of censorship-resistant protocols.

The strategies, roughly in order of how much they change the stream’s appearance:

1. Make the traffic actually resemble something common. The strongest version of this does not merely imitate a protocol, it makes the server actually behave like the thing it appears to be, so a probe cannot tell the difference.
2. Carry the tunnel inside something already allowed. Wrapping in a protocol that is indistinguishable from ordinary web traffic moves the problem from “unknown encrypted protocol” to “ordinary web traffic”.
3. Vary the packet sizes. Padding defeats a classifier that relies on size distribution, at the cost of some efficiency.
4. Rotate. Addresses and identifiers change, so a signature collected last month is stale.

These are the strategies behind Shadowsocks’ AEAD framing, behind HTTP/2 and HTTP/3 disguises, and behind the combination of VLESS with REALITY that Maronix uses. They are not equivalent in strength, and that difference is the substance of the protocol comparisons later on the Atlas Path.

Common misconceptions#

“Encrypted means invisible.” It means the contents are invisible. The envelope is still measured, and measurement has repeatedly been enough.

“DPI reads everything, so nothing helps.” It reads shapes. Shapes can be changed. The tools that work against classification are the ones that keep doing so.

“If my traffic looks like HTTPS, I’m safe.” Appearing as HTTPS is a starting condition, not a guarantee. A system can decrypt handshake-level metadata, can compare a claimed destination with the certificate actually presented, and can probe the address to see whether it really behaves like the site it claims to be.

“My VPN provider says traffic is indistinguishable.” Ask against what, measured how, and by whom. A claim without a measurement behind it is a marketing statement, and this is a page about mechanism rather than branding.

Related#

• What Is Internet Censorship? — the four other layers, of which DPI is one
• What Does Your ISP See? — what a network knows before any classification happens
• What Is a VPN Protocol? — and why the wire appearance is a design constraint
• Obfuscation vs Encryption — the two separate answers, and which one DPI is actually attacking

Last reviewed October 22, 2026. This article was revised after publication. Corrections and additions are welcome.