What Is DPI and How to Bypass It

We often mention DPI in the Amnezia VPN blog, but we have never covered the technology itself in detail — let’s fix that. We’ll work out what these systems are, how they operate, how they’re used, and whether VPNs help get around them.

DPI in Plain Terms

Deep Packet Inspection, or DPI, is a network traffic analysis technology that inspects not only the headers of data packets but also their contents.

With it, telecom operators and government agencies filter, throttle, and prioritize internet traffic in real time, as well as collect statistics about it.

How DPI Systems Are Built

DPI can be compared to a customs officer who not only looks at the information listed on a parcel but opens it up and checks what’s inside.

Classic filtering methods, such as firewalls, are closer to a mail sorter in this comparison. They don’t open the parcel and go only by the information on the outside:

sender and recipient address,
declared weight,
class of shipment.

In this setup, some parameter has to look suspicious for the parcel to be stopped. That made such systems easy to fool.

DPI systems work differently. They get inside the packet and analyze its contents:

traffic type,
format of the file being transferred,
patterns in the structure.

Some DPI systems even see the contents of the parcel. In other words, it’s a full customs checkpoint — with X-rays, dogs, and a complete analysis of shipments.

A Technical Breakdown

Firewalls work at the packet header level: source and destination IP address, port, protocol (TCP/UDP). That’s enough to build simple rules like “Block all traffic from IP 192.0.2.1” or “Open ports 80 and 443 only,” but the packet contents themselves remain unknown for such systems.

DPI systems work differently and use several analysis methods at once:

Signature-based. The system compares packet contents against a database of known patterns — for example, specific text strings, domain names, or byte sequences characteristic of a target resource or protocol.
At the protocol level. DPI systems determine which protocol is ultimately in use, even if the traffic runs over a nonstandard port. For instance, they detect a VPN connection disguised on port 443, which is reserved for HTTPS traffic.
Heuristic (behavioral). Even if the traffic itself is encrypted and can’t be read directly, DPI systems track statistical signs — packet size, packet count, the intervals between them, and the order of the data exchange when a connection is established. From these patterns they guess the traffic type or the very fact that a VPN is in use.

Note that inside unencrypted traffic — for example, to outdated sites on HTTP — DPI can extract even specific data without decrypting the rest of the contents.

How DPI Systems Evolved

The technology grew out of the firewalls mentioned above. Some protected the network through a proxy server that inspected packets in detail; others filtered traffic by IP and ports.

Proxy-based inspection was considered more reliable, and the first DPI systems grew out of it — at the time they resolved network problems, blocked viruses, and protected against DDoS attacks. A lack of computing power limited their use in real time.

Over time, however, DPI systems began to be used by ISPs. At first, to lower the load on the network and show targeted ads. Only later came selective blocking, to fight pirated content and information the authorities disliked.

In some countries, providers are legally required to filter traffic

In Russia, DPI systems came into wide use after the fiasco with the Telegram crackdown in 2018: the selective blocking didn’t achieve its goal, and hundreds of thousands of random IP addresses got caught in the crossfire.

After that, a tool was needed that could block selectively, by packet contents — and so DPI technology became the basis for the “sovereign Runet” law and the TCMT systems, mandatory for all telecom operators.

How DPI Systems Are Used

DPI’s ability to see patterns in packet structure made the technology a universal tool. Most often it’s used to:

Prioritize specific types of traffic over others — for example, speeding up video calls and slowing down torrent downloads.
Block access to specific sites and services by traffic contents, not just by address.
Detect network intrusion attempts and the spread of malware before it can inflict damage.

And so it’s worth clarifying: DPI equipment is used not only by censors — internet providers and companies use it to protect their networks and to optimize the load on their infrastructure. Nonetheless, we’re interested in how this technology is used in the context of blocking.

How DPI Systems Affect the User Experience

You probably wouldn’t notice DPI technology as such, but its effects are easy to spot. Real-time traffic analysis slows the connection: the provider sees access attempts to “undesirable resources” such as social networks, streaming services, or torrent trackers, and deliberately slows it down.

Another problem is over-blocking: a DPI system makes a mistake and, along with the banned resource, cuts off everything that resembles the latter by technical signs. That way, you lose access to dozens of services sharing infrastructure with the blocked one.

DPI systems also get in the way of VPN users. As soon as the provider learns to recognize the next protocol or traffic pattern, the connection drops — and you have to switch to another connection type.

DPI Bypass Methods

At first, encrypting traffic saved the day — DPI systems couldn’t see which site you were opening.

Modern solutions, on the other hand, don’t have to read the contents to block a packet. Strict filtering policies work on the principle “that which is ‘not identified’ is ‘suspicious’,” and an encrypted VPN tunnel is blocked by the characteristic signs of the encryption itself — packet sizes, headers, the order of the data exchange during connection.

Against this backdrop, encryption on its own doesn’t guarantee that a DPI system will let a packet through. To get around it, several approaches are used:

Obfuscation — changing the traffic’s characteristics to make it harder to detect or classify. One obfuscation option is to make the traffic look like random noise, with no stable signs or signatures for DPI to latch onto. The downside is that under a strict filtering policy such “noisy” traffic may be blocked on the principle of “forbidden unless permitted.”
Mimicry — passing traffic off as something legitimate: for example, a connection to an ordinary HTTPS site or DNS traffic. This can make it harder for a DPI system to recognize the connection, but it doesn’t guarantee a bypass.
Traffic fragmentation, decoy packets, and desynchronization — splitting the data into parts, sending it in an unusual order, or padding it with packets that the DPI system and the destination server process differently. As a result, the DPI tool may fail to recognize a banned domain or protocol, while the server receives a correct request.

Which Solutions Bypass DPI

Here are a few tools that make it harder for DPI systems to recognize traffic. Unlike VPN services, they work with traffic locally.

GoodbyeDPI — an open-source utility for Windows. It modifies traffic at the system level to hide the banned target domain from the DPI tool. The server, meanwhile, receives the request correctly.
ByeDPI — works as a local proxy on Windows and Linux at the user level. Despite an implementation different from GoodbyeDPI, it uses similar techniques — splitting and reordering data transfer, and adding decoy packets.
ByeByeDPI — an Android app that uses ByeDPI to process traffic locally. It employs the system service [VpnService] to intercept app traffic, but doesn’t send it to a remote VPN server, add encryption, or hide the user’s IP address.
Zapret

Note that these tools mask the connection from censors but don’t create an encrypted tunnel — attackers can still intercept important data. This happens because tools for fighting DPI hide traffic but at the same time:

don’t hide your original IP address from the site you visit,
don’t add encryption to protocols that transmit data unprotected in the first place,
don’t affect its routing, and so may send it over unsecured channels.

If you want to bypass DPI blocking without losing privacy, use an integral solution, such as the Amnezia VPN services.

Amnezia Free uses the advanced AmneziaWG protocol by default to protect your data and hide your original outgoing IP when connecting to popular resources.
Amnezia Premium — besides AmneziaWG, which mimics a UDP protocol, offers the XRay VLESS Reality combination as an alternative. It simultaneously encrypts data, substitutes the outgoing IP, and disguises traffic as HTTPS or DNS requests.