Studying TLS encapsulated traffic has been around for a long time. I remember one thing that was really obvious to detect was a TCP handshake occurring inside a

Studying TLS encapsulated traffic has been around for a long time. I remember one thing that was really obvious to detect was a TCP handshake occurring inside a TLS session. That's how China is able to block TLS VPNs. Although the practice is a bit of a continuous arms race between obfuscation and detection.