netneutral's comments

You cannot do deep packet inspection, but can identify encrypted packets and then run heuristics and statistical packet and end-point analysis on them.

If Telegram traffic has a specific signature or predictable pattern of packet sequences and sizes married with known IP addresses, quite a lot can be done at the packet inspection level (but not « deep » per se).