How does deep packet inspection actually detect VPN traffic?

Been reading about how ISPs and firewalls identify VPN connections even on port 443. The fingerprinting techniques are surprisingly sophisticated. Anyone here with experience on the detection side?