Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to know how people test if their network connection is secured. So, if I use ssh, I am told that it is secured. But I want to verify this, so I tried to use tcpdump. Below is the command that I used.

tcpdump port 22 -X

then I get the raw packets which I have no knowledge to interpret. Also, I am not sure if this approach is even correct.

Another exercise of this problem is by using telnet. So, I know it is not secure. But when I try to do the following command:

telnet <IP address> 3306

tcpdump port 3306 -X

The tcpdump output looks cryptic to me as well.

Any suggestions / comments?

share|improve this question
I don't think you want to know if the network is secured, you want to know if the network connection is encrypted. You could have an encrypted connection from one host to another but if I had your key it would no longer be secure. – Clutch Feb 19 '10 at 21:44
That is correct. I want to know if the network connection is encrypted. – bichonfrise74 Feb 20 '10 at 2:43
up vote 2 down vote accepted

First I don't run as root so I have to use sudo. You can see packets using this on a Mac.

sudo tcpdump -i en0 -X -s 0 src host <server>

If you can't read what you just typed to the server then it is encrypted. I think to actually take the data and decrypted with the key is beyond what you would find here.

share|improve this answer
I will try this. – bichonfrise74 Feb 20 '10 at 2:55

The best suggestion I can offer is to learn to read the output of the tools you use. Seriously, if you don't know how to interpret the tcpdump why even use it? It's a complex subject but there are many books and articles available to teach you how to read the data.

To make life a lot easier for yourself you should consider using a GUI tool, such as Wireshark, which presents the same information in a format that most people find much easier to read.

share|improve this answer
But is it correct to assume that tcpdump can check if a network connection is encrypted? Unfortunately, I'm using a Linux OS so I'm not sure that Wireshark can be used. – bichonfrise74 Feb 20 '10 at 2:55
I don't use tcpdump, so I can't help there. You can install Wireshark on Linux by building it from source. – John Gardeniers Feb 20 '10 at 8:40
Or you can install wireshark from the package provided by the distribution that you are using. – Justin Feb 21 '10 at 6:27

SSH is a secure protocol. It your machine is really using SSH, it is secure.

If you are interested in the details, you should check the SSH Protocol definition itself.

share|improve this answer
While SSH can be secure it doesn't mean that it is secure. SSH1 protocol is not considered as secure as it's vulnerable to certain man-in-the-middle attacks. When most people mention SSH they are really talking about SSH2. Also you can have a SSH connection using the "none" cipher which is not encrypted. – 3dinfluence Feb 19 '10 at 22:50
Good point, I didn't think about using the "none" cipher – Noah Feb 20 '10 at 1:07

SSH is encrypted and secure, if it thinks anything is wrong (or has changed) it will bleat at you in a very obvious manner. SSHing without an encryption cypher requires an explicit command line switch and it will bleat when you do that to.

tcpdump in and of itself won't tell you if the connection is encrypted or not, you need to analyse the packets yourself. If you don't feel like you can understand the packets directly, then Wireshark can help you there.

share|improve this answer
I think I didn't write the question properly, but I know that SSH is encrypted and secure. What I really want is to know how to make sure the connection is encrypted or not. But you did mention to use Wireshark as others have mentioned it too, so I will try this when I get the chance. – bichonfrise74 Feb 21 '10 at 2:39
Let me rephase my answer. The SSH connection is secure by definition. If it isn't secure and encrypted, SSH will tell you. No execptions. – Haakon Feb 21 '10 at 11:24

Wireshark is the tool which can help you. Install it on your computer and capture the packets for several minuter, if you can see the content in the packets, then it is decrypted.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.