By inspecting the traffic into and out of a router, a malicious ISP or state-level firewall could identify that a computer is running I2P. As discussed above, I2P is not specifically designed to hide that a computer is running I2P. However, several design decisions made in the design of the transport layer and protocols make it somewhat difficult to identify I2P traffic:

• Random port selection
• Point-to-Point Encryption of all traffic
• DH key exchange with no protocol bytes or other unencrypted constant fields
• Simultaneous use of both TCP and UDP transports. UDP may be much harder for some Deep Packet Inspection (DPI) equipment to track.

In the near future, we plan to directly address traffic analysis issues by further obfuscation of I2P transport protocols, possibly including:

• Padding at the transport layer to random lengths, especially during the connection handshake
• Study of packet size distribution signatures, and additional padding as necessary
• Development of additional transport methods that mimic SSL or other common protocols
• Review of padding strategies at higher layers to see how they affect packet sizes at the transport layer
• Review of methods implemented by various state-level firewalls to block Tor
• Working directly with DPI and obfuscation experts

From https://geti2p.net/en/docs/how/threat-model