Deep packet inspection (DPI) is a filtering technique in which network equipment looks beyond the address on each packet and examines its structure, contents and behaviour to work out which application or protocol produced it. Censors, internet providers and strict networks use DPI to recognise VPN protocols by their fingerprints, such as the shape of their handshake, their packet sizes and their timing, and then block or throttle them. Encryption hides what you send, but on its own it does not hide the fact that you are using a VPN.
Packet inspection, from shallow to deep
Every piece of data on the internet travels in packets. Each packet has a header, which works like the envelope of a letter, and a payload, which is the letter inside.
Simple firewalls only read the envelope: where the packet comes from, where it is going and which port it uses. DPI goes further. It notices the envelope's size and shape, how often letters arrive and what the first lines look like, even when the letter itself is sealed.
| Level of inspection | What it looks at | Typical use |
|---|---|---|
| Basic filtering | Addresses and ports | Blocking a known server or a whole service |
| Stateful inspection | Whether packets belong to a valid connection | Ordinary firewalls in homes and offices |
| Deep packet inspection | Payload structure, handshakes, patterns over time | Application detection, traffic shaping, censorship |
How DPI identifies VPN traffic
No single trick catches every VPN. Modern DPI systems combine several signals and act when enough of them point the same way.
Fixed ports and protocol markers
Many VPN protocols use well-known default ports or dedicated protocol numbers. Spotting them takes almost no effort. This is the first and crudest filter, and it still catches a surprising amount of traffic.
Handshake fingerprints
When a VPN connection starts, client and server exchange a few opening messages. In most classic protocols, these messages have a predictable structure: recognisable header bytes, fixed message sizes or a fixed order. A DPI box only needs to see the first few packets to classify the whole connection.
Encrypted web traffic and the server name
Normal secure web browsing begins with a handshake that is visible to the network, including, in most cases, the name of the site being visited. Filters use that name to block websites. They also compare the details of the handshake with those of real browsers. Software that claims to be ordinary web traffic but behaves differently can stand out.
Statistical patterns
Even without reading anything, DPI can measure packet sizes, timing, direction and how random the data looks. A long, steady stream of evenly sized, fully random packets to one address looks different from someone reading the news.
Active probing
Some filters go a step further. When they suspect a server, they connect to it themselves and see how it responds. A server that answers like a VPN, or answers strangely, can be added to a blocklist.
Address reputation
Lists of addresses known to belong to VPN providers, or to data-centre ranges, are used alongside the other signals.
What happens after a VPN is detected
Detection is only the first half. What the network does next shapes your experience.
| Response | What you notice | Why networks use it |
|---|---|---|
| Hard block | The VPN never connects | Simple and decisive |
| Connection resets | Connects, then drops after seconds | Looks like a technical fault |
| Throttling | Connected, but very slow | Harder to prove, frustrates users |
| Selective degradation | Messaging works, video fails | Targets heavy use only |
| Address blocking | One server dies, others work | Cuts off popular servers |
Throttling deserves special mention. A blocked VPN is obvious. A throttled one often is not: the app looks fine, and people blame their phone, their Wi-Fi or the VPN itself.
Why encryption alone does not beat DPI
A common misunderstanding is that strong encryption makes a VPN invisible. It does not. Encryption protects the content of your traffic so nobody on the network can read it. DPI is usually not trying to read it. It is trying to recognise its shape.
A fully encrypted VPN connection with a distinctive handshake is like a locked box with the manufacturer's name printed on the side. Nobody can open it, but everybody knows what it is.
Where DPI is used
DPI is not only a censorship tool. It is used in many places, for different reasons:
- National filtering systems. Several countries, including China, Iran and Russia, use DPI as part of their national internet controls.
- Mobile operators and internet providers, for traffic management, such as slowing down certain kinds of traffic at busy times.
- Corporate and campus networks, for security monitoring and to enforce acceptable-use rules.
- Public Wi-Fi, where hotels and airports may restrict certain services.
Because each network uses DPI differently, the same VPN can work perfectly at home and fail completely on mobile data.
How CyberPort AI responds to DPI
There is no permanent disguise. Any single method that becomes popular enough will eventually be studied and fingerprinted. So the useful question is not "which method is undetectable?" but "what happens when the current method is detected?"
ZoltVPN's answer is CyberPort AI. Instead of one method, it chooses between 10 connection models based on your location, your internet provider and live connection performance. When one is blocked or slowed down, it switches automatically, in seconds, and remembers what works on each network. Throttling is treated as a failure, not as a working connection. You can read how that process unfolds in automatic connection switching.
If you are dealing with heavy filtering, our guides to a VPN for China and a VPN for Iran cover the local situation in more detail.
What you can do on a DPI-filtered network
- Prefer adaptive tools to fixed ones. A single protocol, however good, has one fingerprint.
- Expect change. Filters are often tightened during major events. What worked last month may not work today.
- Keep your app updated, so it benefits from the latest connection improvements.
- Avoid shared public configs. They are easy for filters to find, and they are usually overloaded.
- Follow local laws. Rules on VPN use differ from country to country.
FAQ
Can DPI read my encrypted messages?
Not if the traffic is properly encrypted. DPI sees patterns and metadata, such as sizes, timing and destinations. The exception is a managed device, such as a work laptop, on which the organisation has installed its own security certificate to inspect traffic.
Can any VPN be completely undetectable?
No honest provider can promise that. What matters is how quickly a VPN recovers when a method is detected, which is why adaptive switching makes a real difference.
Why does my VPN work at home but not on mobile data?
Different networks run different filtering equipment and rules. CyberPort AI treats each network separately for exactly this reason.
Is DPI the same as a firewall?
A firewall decides what to allow. DPI is one of the techniques a firewall can use to make that decision with far more detail.
See the rest of what the app can do on the features page, or download ZoltVPN and test it on your own network with the 7-day free trial.
