This question is a bit broad, since it's not asking about a specific program, or a specific network packet you found. A better question would probably be "I have a program that sends network packets, but dumping the packets with wireshark doesn't produce anything readable. I assume the application is encrypting the packets, how can i investigate this"?
You say "Logically any program that sends or receives packets must have the encryption scheme used". This isn't true - your Web browser, FTP client, and many other programs send everything unencrypted. Unless you're using https in your browser, of course, and there's a lot of documentation about how that works.
So, let's assume you have a program, dump the network packets, and assume they're encrypted. So you'd like to know if there's any encryption code in your application. This is what signsrch is for; it detects if your program contains any constants that are used in standard encryption schemes like AES.
Next, you'll want a debugger like Ollydbg, or even IDA Pro, to further analyze the program. There are tons of tutorials out there that show how to use them. However, i won't recommend a specific one, since what is good for you depends very much on how much you know already - any recommendation would be very opinion-based, and we don't like opinion based answers on Stackexchange.