[asharp]

You can fairly easily spot most common protocols by seeing what they 1) Say to you without you prodding them or 2) Respond when you hit them with random data.

My guess is that they're using it as a cheap way to tell the difference between most of the common protocols. (ie. ssh vs. openvpn vs. https, etc.)

[huetsch]

Would an outgoing ssh request be hard to discriminate from an outgoing openvpn request or an outgoing https request? I don't know enough about how the protocols work to understand.

[kahawe]

> Would an outgoing ssh request be hard to discriminate from an outgoing openvpn request or an outgoing https request?

No. But the point probably is: it is much easier and more economic to block the receiving end once by figuring out what it is than having to scan every single outgoing connection all the time.