4

I'm wondering if there is a heuristic plug-in, software or other process for determining protocol when a non-standard TCP port is used.

Wireshark will decode packets based on the well-known port number. For example, TCP 80 will be decoded as HTTP. There is some level of flexibility, such as the ability to define TCP 8080 traffic as HTTP and to be decoded accordingly. My question surrounds decoding non-standard port numbers. You can use the "Decode As..." functionality to do this, provided that the protocol is known.

Below is a session with the server listening on TCP 4443 which is officially Individual Zone Solutions P/L Remote Mail Checking Protocol, for which there is no decode and I was pretty sure is not what it is:

TCP decode

I took a wild guess, based on the similarity of 443 and 4443 and did a "Decode As..." SSL and was rewarded with:

enter image description here

This worked, however it could be lots of guessing/trial and error. Since I can analyze the payload and most likely find clues as to the protocol, is there an automated method to do the same within Wireshark or another tool?

Improve this question

2 Answers 2

Reset to default
2

You need software that does DPI (Deep Packet Inspection). Some companies have made standard rules for some protocols, where in a TCP or UDP packet or some sequence, it can identify the protocol or application that is running.

This kind of application realizes an analysis of Layer 7 of a packet, matching the packet content with a huge rules database.

Like @ojs said, you can try with nDPI from ntop, test it and see the results.

Cisco also has its own database that can be used with the OPNManager, but requires a license.

Improve this answer
3
  • ndpi might work.
    – ojs
    Commented Dec 16, 2015 at 23:09
  • @ojs or Orlando - I haven't tested but that looks promising. Formulate as an answer and I can accept it.
    – AbraCadaver
    Commented Jun 15, 2016 at 18:50
  • Most protocols should be easy to determine by firts bytes so we can make a simplest DPI. There is a proxy sslh that splits SSH, HTTP and TLS traffic from one port and its sources easu to undertsand github.com/yrutschle/sslh/blob/master/probe.c
    – Sergey Ponomarev
    Commented Dec 9, 2023 at 6:30
2

ther is many ways to do so

  1. to use netstat and is extensions in the CMD . it will give you all you want .

examples in images

enter image description here

enter image description here

a good tutorial for netstate commands NETSTATE COM

i know it is a very hard way to do so but it is free of charge

  1. SolarWinds Response Time Viewer for Wireshark
    it is the revers engineering of you question . it will list the applications used in you session and all related details

SW

enter image description here

  1. other wise you will need to bay for monitoring tool include DPI features (i.e. solarwinds , manageenginee )
Improve this answer
3
  • Thanks for the detailed answer. 1. I am very aware of netstat, however all I have is a capture. Also, in my case it would show TCP 0.0.0.0:4443 [someapp.exe] which doesn't tell me that it's SSL. 2. It would be interesting to confirm, but I'm pretty sure that is determining application by port as well. 3. Would be nice as an open source plugin/tool.
    – AbraCadaver
    Commented Sep 17, 2015 at 20:29
  • it sound like you need plugin work as a port awareness to each captured packet to identify its type (HTTP ,HTTPS etc)
    – Gadeliow
    Commented Sep 17, 2015 at 21:42
  • the nearest way to perform what you need is to use the solarwinds RTV with wiresharke . first capture the traffic by wireshark as you did , save your capture , apply it to the RTV , you will get the list of application contained in you capture and then you can export packets done by certain application and reopen it with wireshark . this way you can get info even on the unknown TCP port number APP ()
    – Gadeliow
    Commented Sep 17, 2015 at 22:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.