I captured some plain TCP packets (not HTTP) which are not using HTTPS.

I am wondering whether these packets are using AES 256 (or 128) or not.

Is there a way to do that?


  • 1
    $\begingroup$ Are you familiar with the 7 layer OSI comms model? If so, at which level do you believe that encryption might have taken place? $\endgroup$ – Paul Uszak May 30 '17 at 11:55
  • $\begingroup$ You may try to measure "entropy" of your data, with binwalk -E for example, but this won't tell you the encryption scheme, and will also be triggered by other things like compressed data, so it's not perfect... $\endgroup$ – Lery May 30 '17 at 13:13
  • $\begingroup$ @Lery The word you're looking for is useless. binwalk can't usefully differentiate between a JPEG or a ZIP file. And the entropy of 1500 byte long packets of pure randomness will also vary somewhat due to normal stochastic fluctuations. $\endgroup$ – Paul Uszak May 30 '17 at 13:59
  • $\begingroup$ @Paul, I must say that even if I find it a bit of a strong word, I agree. It may somehow help determine something is not encrypted with high probability, but still... However, I wanted to link that other question since I find them related. $\endgroup$ – Lery May 30 '17 at 14:05
  • $\begingroup$ @PaulUszak what i want to know is application layer encryption, thanks $\endgroup$ – takita May 31 '17 at 7:59

Without knowing anything about the application layer protocol on top of TCP, it's very hard to answer this question.

A good symmetric cipher (like AES) will produce uniformly random bytes. So if the data in the packet looks uniform, there's a very good chance it's been encrypted. You won't be able to distinguish between different algorithms, though, and you probably won't be able to distinguish between different modes of operation.

Your best bet is to figure out the application protocol being used, and look at the corresponding messages establishing the connection.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.