diff --git a/prog/weaver/metrics.go b/prog/weaver/metrics.go
index cb47b248b2..ed00bb5320 100644
--- a/prog/weaver/metrics.go
+++ b/prog/weaver/metrics.go
@@ -44,14 +44,30 @@ func uint64Counter(desc *prometheus.Desc, val uint64, labels ...string) promethe
 }
 
 var metrics = []metric{
-	{desc("weave_connections", "Number of peer-to-peer connections.", "state"),
+	{desc("weave_connections", "Number of peer-to-peer connections.", "state", "type", "encryption"),
 		func(s WeaveStatus, desc *prometheus.Desc, ch chan<- prometheus.Metric) {
-			counts := make(map[string]int)
+			counts := make(map[ /*state*/ string]map[ /*type*/ string]struct{ encrypted, unencrypted int })
+			for _, state := range allConnectionStates {
+				counts[state] = make(map[string]struct{ encrypted, unencrypted int })
+			}
 			for _, conn := range s.Router.Connections {
-				counts[conn.State]++
+				typeName := "unknown"
+				if t, ok := conn.Attrs["name"]; ok {
+					typeName = t.(string)
+				}
+				c := counts[conn.State][typeName]
+				if e, ok := conn.Attrs["encrypted"]; ok && e.(bool) {
+					c.encrypted++
+				} else {
+					c.unencrypted++
+				}
+				counts[conn.State][typeName] = c
 			}
-			for _, state := range allConnectionStates {
-				ch <- intGauge(desc, counts[state], state)
+			for state, stateCounts := range counts {
+				for connType, count := range stateCounts {
+					ch <- intGauge(desc, count.encrypted, state, connType, "yes")
+					ch <- intGauge(desc, count.unencrypted, state, connType, "")
+				}
 			}
 		}},
 	{desc("weave_connection_terminations_total", "Number of peer-to-peer connections terminated."),
diff --git a/test/101_cross_hosts_2_test.sh b/test/101_cross_hosts_2_test.sh
index 70039b2b15..a8cf580a56 100755
--- a/test/101_cross_hosts_2_test.sh
+++ b/test/101_cross_hosts_2_test.sh
@@ -24,5 +24,6 @@ weave_on  $HOST2 attach $C2/24 c2
 
 wait_for_x network_tester_status "network tester status"
 assert "echo $status" "pass"
+assert "connections_metric $HOST1 encryption=\\\"\\\",state=\\\"established\\\"" "1"
 
 end_suite
diff --git a/test/110_sleeve_encryption_2_test.sh b/test/110_sleeve_encryption_2_test.sh
index 13ebc16147..05463fcdb9 100755
--- a/test/110_sleeve_encryption_2_test.sh
+++ b/test/110_sleeve_encryption_2_test.sh
@@ -16,5 +16,6 @@ assert_raises "exec_on $HOST1 c1 $PING $C2"
 
 assert_raises "weave_on $HOST1 status connections | grep -P 'encrypted *sleeve'"
 assert_raises "weave_on $HOST2 status connections | grep -P 'encrypted *sleeve'"
+assert "connections_metric $HOST1 encryption=\\\"yes\\\"",state=\\\"established\\\" "1"
 
 end_suite
diff --git a/test/111_fastdp_encryption_2_test.sh b/test/111_fastdp_encryption_2_test.sh
index 4202af85bd..d56b7a4c98 100755
--- a/test/111_fastdp_encryption_2_test.sh
+++ b/test/111_fastdp_encryption_2_test.sh
@@ -44,6 +44,7 @@ weave_on $HOST2 launch --password wfvAwt7sj $HOST1
 
 assert_raises "weave_on $HOST1 status connections | grep -P 'encrypted *fastdp'"
 assert_raises "weave_on $HOST2 status connections | grep -P 'encrypted *fastdp'"
+assert "connections_metric $HOST1 encryption=\\\"yes\\\"",state=\\\"established\\\" "1"
 
 PCAP1=$(mktemp)
 PCAP2=$(mktemp)
diff --git a/test/115_optional_encryption_2_test.sh b/test/115_optional_encryption_2_test.sh
index 89870b1023..d7f47443c6 100755
--- a/test/115_optional_encryption_2_test.sh
+++ b/test/115_optional_encryption_2_test.sh
@@ -17,6 +17,7 @@ weave_on $HOST1 launch --password wfvAwt7sj --trusted-subnets $HOST2_CIDR
 weave_on $HOST2 launch --password wfvAwt7sj $HOST1
 assert_raises "weave_on $HOST1 status connections | grep encrypted"
 assert_raises "weave_on $HOST2 status connections | grep encrypted"
+assert "connections_metric $HOST1 encryption=\\\"yes\\\"",state=\\\"established\\\" "1"
 
 weave_on $HOST1 stop
 weave_on $HOST2 stop
@@ -26,5 +27,6 @@ weave_on $HOST1 launch --password wfvAwt7sj --trusted-subnets $HOST2_CIDR
 weave_on $HOST2 launch --password wfvAwt7sj --trusted-subnets $HOST1_CIDR $HOST1
 assert_raises "weave_on $HOST1 status connections | grep unencrypted"
 assert_raises "weave_on $HOST2 status connections | grep unencrypted"
+assert "connections_metric $HOST1 encryption=\\\"\\\"",state=\\\"established\\\" "1"
 
 end_suite
diff --git a/test/config.sh b/test/config.sh
index f0df952bad..3b599ffa23 100644
--- a/test/config.sh
+++ b/test/config.sh
@@ -267,6 +267,10 @@ wait_for_attached() {
     wait_for_x "check_attached $1 $2" "$2 on $1 to be attached"
 }
 
+connections_metric() {
+    $SSH $1 curl -sS http://127.0.0.1:6784/metrics | awk -e "/^weave_connections.*$2/ { print \$2 }"
+}
+
 # assert_dns_record <host> <container> <name> [<ip> ...]
 assert_dns_record() {
     local host=$1