It works at different levels. First, they try to drop the connection during handshake (which is NOT encrypted yet). This works effectively. SSH has been taken d

It works at different levels. First, they try to drop the connection during handshake (which is NOT encrypted yet). This works effectively. SSH has been taken down using this technique for a few months. They also shape the bandwidth of encrypted connections. My guess is that they use something like L7 to guess the type-of-connection using different patterns.