I often read that your ISP can tell if you are using Tor. Assuming you use a bridge the only way to do this seems to be statistical analysis of a packet capture. How exactly is this done given that the initial connection is over TLS and can you prevent it?
Standard Tor traffic
Default Tor entry nodes are publicly listed. So, to block a standard Tor connection, your ISP just needs to check the IPs you're connecting to against a list of known nodes (called "entry guards").
For example, my Tor browser randomly chose
220.127.116.11 as the entry point from a list of public nodes. Now, an eavesdropper could just look up the IP on Atlas (you can filter guard nodes with
flag:Guard) to conclude I'm a Tor user.
Bridges are unlisted Tor relays and therefore can't be blocked as easily. But research suggests that bridges can potentially be identified by analyzing their incoming and outgoing traffic (as linked in @user169339's answer).
Another option for an eavesdropper is to employ DPI to inspect your initial TLS handshake when connecting to the Tor network. E.g., the authors of the paper Detecting and blocking onion router traffic using deep packet inspection observed some characteristics which can be easily deployed as firewall rules, among them:
The cipher suites offered by the Tor client are always the same.
ClientHellomessage, the indicated
server_nameis always a random domain name in the form of
Subject and issuer of the certificate presented during the handshake also have this random domain set in the
commonNamefield which should be easy to distinguish from legitimate certificates.
In a quick test I could successfully sniff some pseudo domains from a Tor TLS handshake:
www.65nrpfd6bt7h.com www.dgb2ozu32a6mjxhrijwa5gtp5.com www.arqnns3y6lowbr3ses67cb.com
(Even the random domains alone, although you might not be able to filter them reliably, could certainly attract the attention of your local sysadmin.)
Pluggable transports are the Tor project's attempt to overcome DPI-based blocking by providing an API to exchange Tor traffic over arbitrary (obscured) protocols which are harder for firewalls to detect:
Pluggable Transports help you bypass censorship against Tor.
Pluggable Transports (PT) transform the Tor traffic flow between the client and the bridge. This way, censors who monitor traffic between the client and the bridge will see innocent-looking transformed traffic instead of the actual Tor traffic. External programs can talk to Tor clients and Tor bridges using the pluggable transport API, to make it easier to build interoperable programs.
You are partially correct. Statistical analysis is the route to take, but it is the packet metadata and not payload that will allow the ISP to detect Tor. At the following link, they talk about an 86.7% online detection rate and their method for detection. I have a colleague that is able to do it at ~97% using inter-packet timing, packet sizes, etc. With that said, I don't know of any commercial products that are currently blocking Tor bridges so if ISP's are truly detecting/blocking them I'm guessing it's done with in-house solutions. Maybe DarkTrace?