Russian DPI (Deep Packet Inspection) systems are not just a 'black box' — they are complex traffic analysis tools. A recent breakdown on Habr explains in detail how these devices distinguish legitimate traffic from blocked content, and why some VPN protocols work while others fail.
Stupid vs. Smart Blocking
The author divides blocking methods into two types. 'Stupid' blocking works by IP addresses and ports — easy to bypass by changing servers. 'Smart' blocking analyzes packet contents: SNI (Server Name Indication) in TLS handshakes, packet sizes, timing delays, and even protocol signatures. Smart blocking breaks many VPNs because it detects characteristic patterns.
How DPI Sees VPNs
DPI systems inspect traffic at the packet level. They identify VPNs by:
- Non-standard ports (e.g., 443 for OpenVPN);
- Characteristic packet headers;
- Encryption patterns (e.g., fixed block sizes).
Some DPI systems also use active probing — sending special packets to provoke a response from the VPN server.
What Works Best
Protocols that disguise traffic as regular HTTPS perform best. For example:
- VLESS with XTLS — uses a TLS session that looks like a normal HTTPS request;
- Shadowsocks with AEAD encryption — encrypts all traffic, leaving no visible signatures;
- WireGuard — lightweight and fast, but requires additional obfuscation (e.g., via a proxy).
Important: even the best protocols are not 100% guaranteed if DPI uses active probing or timing analysis.
How to Choose a Client
The client should be open-source, support obfuscation, and receive regular updates. Popular options: v2ray/xray, Sing-box, Outline. For mobile — V2RayNG or Shadowrocket.
What the Future Holds
The author predicts DPI systems will evolve toward machine learning for traffic analysis. This means bypass methods must also become smarter — using dynamic obfuscation and random delays.