How Governments Detect VPN Traffic, and Why Encryption Alone Doesn't Hide It
How Governments Detect VPN Traffic, and Why Encryption Alone Doesn’t Hide It
A VPN that works perfectly at home can stop working the moment its user lands in a country with a national firewall. That’s because a VPN hides what you send, not that you’re using a VPN. Censors don’t need to read your traffic to stop it; they read everything around it: the handshake that opens the connection, the size and timing of packets, the reputation of the server’s IP address, and how that server responds when someone else knocks on its door. Detecting VPN traffic is a contest over signals, not encryption strength. 🚀
Network operators layer detection methods. The simplest approach is to block the addresses VPN servers live on, as commercial VPNs sit in known datacenter ranges. Additionally, many networks simply drop traffic on ports they don’t expect or block UDP outright. Deep packet inspection (DPI) looks at the structure of the traffic, and major VPN protocols are easy to recognize, such as WireGuard’s fixed handshake types and sizes. A USENIX Security 2022 paper found researchers identified over 85% of OpenVPN flows with negligible false positives. China’s Great Firewall has also used active probing for years to discover hidden Tor bridges and Shadowsocks servers.
For years, the standard advice for beating DPI was to make traffic look like nothing at all, with protocols like Shadowsocks encrypting every byte to appear as uniform random noise. However, in November 2021, China’s Great Firewall turned that idea on its head. A USENIX Security 2023 study found the censor had stopped trying to identify those protocols directly. Instead, it used simple, cheap rules to exempt traffic unlikely to be fully encrypted, treating everything else as suspect. The system allowed traffic resembling recognized protocols or meeting exemption rules, which examined elements like the proportion of set bits and printable ASCII characters in the first TCP data packet. The lesson for anyone designing or relying on circumvention tools is uncomfortable: randomness is itself a signal. A connection that starts with nothing stands out.
The response has been to stop looking like nothing and start looking like something ordinary. Many VPN providers now offer “stealth” or obfuscated protocols that wrap the tunnel inside traffic built to resemble a normal HTTPS session, such as Proton VPN’s Stealth protocol launched in October 2022. Providers are also wrapping WireGuard inside other transports, including QUIC and Shadowsocks. National firewalls get the headlines, but scaled-down versions of the same stack run on office and university networks every day. For users, “the VPN connected” doesn’t mean “the VPN went unnoticed,” and a connection can be allowed through but still logged as VPN traffic. Ultimately, VPN detection isn’t about breaking encryption; it’s about reading everything encryption leaves exposed: addresses, ports, handshakes, entropy, and behavior under probing. Obfuscation can reduce some of these signals, but a successful connection does not prove that VPN use went undetected.