I captured some plain TCP packets (not HTTP) which are not using HTTPS.
I am wondering whether these packets are using AES 256 (or 128) or not.
Is there a way to do that?
Thanks
Without knowing anything about the application layer protocol on top of TCP, it's very hard to answer this question.
A good symmetric cipher (like AES) will produce uniformly random bytes. So if the data in the packet looks uniform, there's a very good chance it's been encrypted. You won't be able to distinguish between different algorithms, though, and you probably won't be able to distinguish between different modes of operation.
Your best bet is to figure out the application protocol being used, and look at the corresponding messages establishing the connection.
binwalk -E
for example, but this won't tell you the encryption scheme, and will also be triggered by other things like compressed data, so it's not perfect... $\endgroup$