# Is it possible to figure out whether a plain TCP packet is (aes) encrypted or not?

I captured some plain TCP packets (not HTTP) which are not using HTTPS.

I am wondering whether these packets are using AES 256 (or 128) or not.

Is there a way to do that?

Thanks

• Are you familiar with the 7 layer OSI comms model? If so, at which level do you believe that encryption might have taken place? – Paul Uszak May 30 '17 at 11:55
• You may try to measure "entropy" of your data, with binwalk -E for example, but this won't tell you the encryption scheme, and will also be triggered by other things like compressed data, so it's not perfect... – Lery May 30 '17 at 13:13
• @Lery The word you're looking for is useless. binwalk can't usefully differentiate between a JPEG or a ZIP file. And the entropy of 1500 byte long packets of pure randomness will also vary somewhat due to normal stochastic fluctuations. – Paul Uszak May 30 '17 at 13:59
• @Paul, I must say that even if I find it a bit of a strong word, I agree. It may somehow help determine something is not encrypted with high probability, but still... However, I wanted to link that other question since I find them related. – Lery May 30 '17 at 14:05
• @PaulUszak what i want to know is application layer encryption, thanks – takita May 31 '17 at 7:59