If one suspects one's packets are subject to DPI, how can it be detected?
It depends on the kind of DPI you are talking about. If it is purely passive DPI (i.e. only looking at the packets) then you will not be able to detect it. If this is instead DPI which can modify the data then you might be able to detect it depending on the kind of access and knowledge you have.
Some typical examples on how active DPI devices change traffic, i.e. what you can look for:
- If you transfer specific data (like known malware) the transfer will fail because the IDS detected and blocked the possible attack. One could use for example the innocent EICAR test virus.
- DPI using SSL interception can be detected because the certificate is issued by a different CA.
- Some DPI devices strip STARTTLS from SMTP traffic so that the traffic will not be encrypted and can be analyzed. Such change to the traffic can be observed on the client side.
- Some devices modify the "Accept-Encoding" header of a HTTP request to strip unsupported compression schemes. This can be observed on the server side or sometimes on the client side too because the content is not transferred compressed.