What custom TCP/IP packets or other statistics can I use to detect VPN usage?
I understand that this may generate a number of false positives, but my goal is to focus analysis on certain types of traffic.
Possible examples include:
- Browser reports geolocation doesn't match expected latency to that site is much higher than expected
- Ping with the DF set
- Custom packet size + MTU tests
- SSL protocol features (spdy? fido?)
I'm mostly interested in using SSL/TCP/IP/ICMP to detect such connections... as opposed to browser-DNS leaks, flash, or other approaches, but think other people may find it interesting if you have such a non TCP based detection method.