Encrypted traffic should be indistinguishable from random numbers. A quick test is trying to compress it, as true randomness has no patterns and hence nothing

Encrypted traffic should be indistinguishable from random numbers. A quick test is trying to compress it, as true randomness has no patterns and hence nothing to compress. In general you can tell exactly what compression was used because protocols start out in the clear and include some sort of negotiation. https://en.wikipedia.org/wiki/Transport_Layer_Security#Protocol_details https://en.wikipedia.org/wiki/Transport_Layer_Security#Proto... However both ends can separately agree that if they select one cipher suite, they will be secretly using a different one.