If you are able to capture a flow from begin to end, you can use something like the entropy of the flow to guess if a tunnel is encrypted or not..