[Multrex]

Can someone ELI5 how they identify VPN at the protocol level?

[ytch]

For the case in China, they use statistics, entropy of packets (may not an accurate term) and other DPI-like methods[1],

also HN discussions of it[2]:

[1] https://gfw.report/publications/usenixsecurity23/en/

[2] https://news.ycombinator.com/item?id=36531485

[vbezhenar]

DPI. Popular VPN protocols are easily identified by first connection packet signature.

[littlestymaar]

Wasn't Wireguard explicitly designed to avoid that? (IIRC it took lots of inspiration from state of the art data exfiltration methods used by malware)

[inrussianow]

INAE, but I think they sniff the initial handshake the protocols have and then drop subsequent packets.