A system that performs encrypted media detection for real-time communications (“RTC”) establishes a tunnel by a tunneling server with a tunneling client of a user equipment (“UE”). The system receives a request from the UE to enable the encrypted media detection for the tunnel and sends a response back to the UE to indicate that the encrypted media detection is enabled for the tunnel. For each encrypted frame transmitted over the tunnel, the system stores corresponding data that includes at least one of a payload size, an inter-frame delay or a payload entropy. Based on stored corresponding data, the system determines if the encrypted frame includes an encrypted media data frame.