AnyProxy

Get Pro
Glossary · Web tech

DPI (Deep Packet Inspection)

Also calleddeep packet inspectiondpi filter
Definition

Deep packet inspection (DPI) is network equipment that looks beyond a packet's addresses into its contents and patterns, to recognise and block or slow specific sites and apps.

Explanation

In depth

A basic firewall decides on IP address and port alone. A DPI system reads further: the site name in an HTTPS handshake (SNI), the first bytes of a protocol, packet sizes and timing. It uses those to tell a VPN from a video call, or YouTube from a news site, even when the content itself is encrypted. It cannot read HTTPS pages unless your device trusts a certificate the operator controls. National networks use DPI to block, but also to slow selected services while leaving the rest of the connection alone. OONI documented this in Turkiye: on 8 September 2025, TLS handshakes to X, YouTube, Instagram and other platforms took much longer than handshakes to 19 other hostnames on the same IP prefixes. Only DPI picking out those names explains that pattern. Russia's 2019 'sovereign internet' law required ISPs to install state-run DPI boxes, which Roskomnadzor later used against Cloudflare's Encrypted Client Hello in November 2024. DPI is good at spotting VPN protocols by their handshakes. Plain HTTPS to an ordinary-looking website, which is what a web proxy uses, gives it much less to single out, but the proxy's own domain can still be listed and blocked.

In practice

DPI (Deep Packet Inspection) in the real world

OONI's November 2025 report on Turkiye shows DPI in action without any page being 'blocked'. During the 8 September 2025 restrictions, OONI compared TLS handshake times to twitter.com with 19 other hostnames served from the same IP prefixes. Only the targeted platforms were slow. The same network and the same addresses gave different speeds per name, so the equipment had to be reading which site each connection was for.

Sources: OONI — Throttling of social media in Turkiye (20 Nov 2025) · Risky Biz News — Russia blocks Cloudflare ECH connections (Nov 2024) · OONI — Iran censorship study (2025)

Questions about DPI (Deep Packet Inspection)

Can DPI read my HTTPS pages?
Not without a certificate your device trusts. It can still see the site name (SNI), packet sizes and timing, which is enough to block or slow a service.
Why do VPNs stop working in some countries?
DPI recognises VPN protocols by their handshakes and traffic shape. Ordinary HTTPS to a normal website, as a web proxy uses, is harder to single out.
How do I know a site is being slowed rather than blocked?
It loads, but far slower than other sites on the same connection. In Turkiye, OONI measured this as much longer TLS handshakes for targeted platforms only.
See alsoHow network filters work

Related terms

TLS SNISNI (Server Name Indication) is the field at the start of an HTTPS connection where your browser names the site it wants, usually in readable text.SNI inspectionSNI inspection is a filtering technique: a firewall reads the site name from the start of an HTTPS connection and cuts or logs the connection if the name is on a list.DNS filteringDNS filtering blocks a website by making the address lookup fail or point somewhere else, so your browser never reaches the real server.GFW (Great Firewall of China)The Great Firewall is the filtering system on mainland China's international internet links that stops people inside China from reaching blocked foreign sites and apps.

Put the concept to work

Try AnyProxy free — no install, no signup, six regions.

Open a blocked page