Put simply, AFAIU, it's the pattern of TCP packet sizes. OpenVPN, for example, has a very recognizable handshake that makes it prone to detection. This post goes into some of the network-level details (not OpenVPN-specific): http://blog.zorinaq.com/my-experience-with-the-great-firewal...