How to check the Oracle database connection encryption type?(between Oracle database and other client applications)How do I assure between Oracle database and Toad the database connection is encrypted? (My Toad version is 9.5 and Oracle database version is 11g)


4 Answers 4


Don't confuse Oracle Advanced Security with encrypted SSL client connections to the database. The Advanced Security option is comprised of two main features, Data Radaction and Transparent Data Encryption. TDE is the encryption of data within tables, so that if someone captures the datafiles they won't be able to read table data in the clear inside the file.

An encrypted SSL connection between a client and the database is just part of the Oracle Net Services and is included with every version. The Oracle documentation explains how to set that up.

To answer your question, run this query:

SELECT sys_context('USERENV', 'NETWORK_PROTOCOL') as network_protocol FROM dual;

If you are connected via SSL you will get the response


If you get "tcp," then you are on a non-SSL connection.

  • 1
    It's really confusing because Native Encryption and SSL USED to be part of ASO. A few years ago Oracle changed it to make it available on all licenses. However, they (still!) haven't updated all their documentation, so it's still referenced as being part of ASO in many places.
    – Elezar
    Apr 21, 2016 at 23:55
  • 3
    Update for SQL*Net Native Encryption: The above statement shows "tcp" for native encryption even if the communication itself ist encrypted.
    – jmk
    Aug 10, 2018 at 7:14
  • Indeed a session using OAS appears as tcp: one can check it it is working with "select sid, network_service_banner from v$session_connect_info where osuser='<user>' order by sid" and you should see something like "Oracle Advanced Security: <algo> encryption service adapter for <os>: Version <version> - Product" Oct 20, 2022 at 13:42

Unless you've done 'something' to encrypt the connection it is in the clear.

And if you want to encrypt this communication using an Oracle solution, you must be using the Enterprise Edition and you must purchase the Advanced Security addon.

If you the free way of doing this, use Stunnel https://www.stunnel.org/index.html

Amazingly enough, Stunnel and Advanced Security have many similarities. I've installed both, and like Stunnel.

Stunnel is great, especially when you want to make https connections from a stored procedure. Oracle requires all sorts of hoops like installing the client's certificate in the Wallet (which I think is now gone--finally--yet replaced with some other cumbersome idea. Where as, Stunnel just needs 3 lines of code in a setup file.

Anyway, unless you have a requirement to use Advanced Security Option, look into Stunnel.

And to see if you're running ASO, look in your sqlnet.ora file for strange entries this:


Look in both the client and the server's sqlnet.ora file.

  • @sam_mit, as it looks like you are new to StackOverFlow, when someone answers a question and you like it, you want to click the "check mark" beside the answer.
    – Brian McGinity
    Jan 20, 2014 at 3:44
  • Also, you're welcome. You and (others) can save yourself $20k knowing this...
    – Brian McGinity
    Jan 20, 2014 at 3:45

Encryption configurations are in the server sqlnet.ora file and those can't be queried directly. However this link from Oracle shows a clever way to tell anyway:

Synopsis from the above link:

Verifying the use of Native Encryption and Integrity

You can verify the use of native Oracle Net Services encryption and integrity by connecting to your Oracle database and examining the network service banner entries associated with each connection. This information is contained in the NETWORK_SERVICE_BANNER column of the V$SESSION_CONNECT_INFO view. The following example shows the SQL command used to display the network service banner entries associated with current connection:

SQL> select network_service_banner 
     from v$session_connect_info 
     where sid in (select distinct sid from v$mystat);

The following example output shows banner information for the available encryption service and the crypto-checksumming (integrity) service, including the algorithms in use:

TCP/IP NT Protocol Adapter for Linux: Version - Production
Encryption service for Linux: Version - Production
AES256 Encryption service adapter for Linux: Version - Production
Crypto-checksumming service for Linux: Version - Production
SHA1 Crypto-checksumming service adapter for Linux: Version - Production

If native Oracle Net Services encryption and integrity was not in use, the banner entries would still include entries for the available security services; that is, the services linked into the Oracle Database software. However, there would be no entries indicating the specific algorithms in use for the connection. The following output shows an example:

TCP/IP NT Protocol Adapter for Linux: Version - Production
Encryption service for Linux: Version - Production
Crypto-checksumming service for Linux: Version - Production
  • It works through select DISTINCT network_service_banner from v$session_connect_info
    – caot
    May 4, 2021 at 16:45

select a.sid,a.serial#,b.network_service_banner, a.sql_id,a.username, a.logon_time,a.machine,a.program, a.osuser, a.status from v$session a, v$session_connect_info b where a.sid=b.sid and a.serial#=b.serial# and a.username='USER';

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.