3

I am using a VPN to ensure to encrypt my traffic.

I wonder though if I could check somehow if the datastream really is encrypted?

  • 4
    You can use Wireshark to capture all data coming in and out of your interface. What do you mean by "safety of my browsing"? – RoraΖ Sep 10 '14 at 11:23
  • Are you worried about accidental lack of encryption, or an attack? – forest Feb 19 at 3:04
5

Do some sort of packet capture. Depending on your level of concern and technical ability you have two relatively easy methods available.

If you have tcpdump installed just run tcpdump -A -c 200 if the output is clear text then this is a clear answer. If it is not then possibly your traffic is encrypted. (note: it could just be encoded and not encrypted, you have to verify this).

Another option is wireshark. You can do the same analysis but with a nice GUI to filter out specific traffic and follow TCP streams.

These are the tools, you will have to do a meaningful analysis to actually verify encryption.

2

You can use Entropy Estimation for the stream data. Let's say the payload is encoded in ASCII or ANSI and for printable characters values from 32 to 127 are used . Based on the entropy of the encoded symbols of the stream, you can develop an algorithm that identifies any text blocks within the payload (in case of unencrypted data) or not. In this case,the entropy is used to identify statistical variation of bytes seen on the stream.

http://jmlr.csail.mit.edu/proceedings/papers/v31/clifford13a.pdf

The other option is to use the Chi-Squared Test for detecting encrypted traffic.

https://en.wikipedia.org/wiki/Chi-squared_test

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.