Most cleartext protocols have an encrypted twin running on a different port. If you see one, the other is usually nearby.