# Beat data with SSL vs unencrypted - no visible difference in the packets

**URL:** <https://discuss.elastic.co/t/beat-data-with-ssl-vs-unencrypted-no-visible-difference-in-the-packets/136533>\
**Category:** Beats\
**Created:** [June 19, 2018, 3:55pm UTC](https://discuss.elastic.co/t/beat-data-with-ssl-vs-unencrypted-no-visible-difference-in-the-packets/136533 "2018-06-19T15:55:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![beatit](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/beatit/32/32441_2.png) [@beatit](https://discuss.elastic.co/u/beatit)\
**Post date:** [June 19, 2018, 3:55pm UTC](https://discuss.elastic.co/t/beat-data-with-ssl-vs-unencrypted-no-visible-difference-in-the-packets/136533/1 "2018-06-19T15:55:54Z")

</div>

Greets.

I'm using metricbeat 6.2.4 on Windows and Logstash 6.3.0-1 on Debian 8.

I got SSL set up and then thought for the heck of it I'd compare packets in Wireshark and found that the traffic looks exactly the same when sending beats with and without SSL. I remember reading that without SSL the traffic is plaintext, so that was what I was expecting to see and just wanted to verify the SSL was set up properly. Can anyone explain why this is? Do the newer \*beats have encryption of some sort baked in?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [June 19, 2018, 4:01pm UTC](https://discuss.elastic.co/t/beat-data-with-ssl-vs-unencrypted-no-visible-difference-in-the-packets/136533/2 "2018-06-19T16:01:41Z")

</div>

I believe the beats protocol by default applies compression, which may be what you are seeing.

---

<div class="post-metadata">

**Author:** ![beatit](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/beatit/32/32441_2.png) [@beatit](https://discuss.elastic.co/u/beatit)\
**Post date:** [June 19, 2018, 4:10pm UTC](https://discuss.elastic.co/t/beat-data-with-ssl-vs-unencrypted-no-visible-difference-in-the-packets/136533/3 "2018-06-19T16:10:15Z")

</div>

Hey thanks for the quick answer. If noone else replies I will assume that is the case. It isn't like any super sensitive data is going to be sent over this aside from usernames but better safe than sorry. I don't want anyone to know my username is password!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 17, 2018, 6:10pm UTC](https://discuss.elastic.co/t/beat-data-with-ssl-vs-unencrypted-no-visible-difference-in-the-packets/136533/4 "2018-07-17T18:10:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
