I don't remember the specifics, but there were a lot of different packet types (eg UDP not just TCP) and protocols that ExpressVPN used to negotiate and transfer data. I'm sure there was quite a bit of cat-mouse, but I also assumed that there might be a symbiotic (or more) connection between Chinese security and ExpressVPN. I just wanted things to work, and didn't care so much about the actual "privacy" of the tunnel.
