This question already has an answer here:

I was recently discussing the UAE blocking VPN services and wondered how an SSL VPN connection, running on port 443 would look any different from a website streaming large files over HTTPS? They both would use the same protocol, so even DPI would only result show encrypted traffic over SSL. Therefor what differentiates a VPN over SSL from regular web traffic over SSL, and how would a MIM detect and enforce against the difference?

marked as duplicate by Steffen Ullrich tls Dec 7 '16 at 17:50

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • SNI and the certificate are transmitted in the clear. VPN handshake looks different. You can disguise a VPN though. – Z.T. Dec 7 '16 at 17:50
  • also: Identify HTTPS vs Application SSL Traffic. In short: network flow characteristics differ significantly between HTTPS and VPN. – Steffen Ullrich Dec 7 '16 at 17:51
  • @SteffenUllrich I'm not sure this is a duplicate. That question refers to VPNs in general, this question specifies SSL VPNs. – RoraΖ Dec 7 '16 at 19:08
  • 1
    @RoraΖ: you are right in that the other link I've added about HTTPS vs. application SSL traffic (which includes also VPN SSL) is more appropriate as the duplicate link but I still consider this a problem which is already discussed and answered. – Steffen Ullrich Dec 7 '16 at 19:27