Deep Packet Inspection (DPI)

Deep packet inspection (DPI) looks past the basic address headers of a packet and analyses its payload and patterns to work out what protocol or application produced it. ISPs, firewalls and national censors use it to identify and sometimes block specific traffic — including VPN and proxy protocols — by matching characteristic signatures. It is the technology that makes protocol-based censorship possible, and the reason obfuscation exists to defeat it.

DPI systems maintain signatures for known protocols and flag traffic that matches, even when the payload is encrypted, by examining handshake patterns, packet sizes and timing. A standard VPN handshake has recognisable features DPI can spot. Countermeasures reshape traffic so it lacks those markers — for example disguising a tunnel as ordinary HTTPS. DPI also underpins TLS fingerprinting and similar analysis, so consistent, browser-like traffic is harder to single out than something with an obvious protocol signature.

s4m cannot change what a network operator inspects, but its protocol choices affect how visible your traffic is. Running the OpenVPN option over TCP on port 443 makes a tunnel resemble HTTPS, which can help on networks that use DPI to block UDP-based VPNs, while WireGuard favours speed on open networks. For everyday privacy this is enough; defeating aggressive DPI-based national censorship is the domain of specialised obfuscation tools beyond s4m's transparent VPN offering.