Wireshark - Application Layer with Data

Question

I am not sure if the title is the correct one. When transfering files over the network, in Wireshark, we see abbreviations like:

- PK -> Beginning of a file. Is it a compressed file?
- OFT2 -> Beginning of a file transfer.
- ELF -> DUMP?
- MZ -> Binary file?

I have several questions, and feel a little bit confused in this topic:

1. Where can I find an extensive list of this abbreviations?
2. Where are this abbreviations coming from? Is it a wireshark thing, is it a file system thing? Because it's on the app layer, is this a app thing?
3. Can someone point me to the right direction to learn more about this topic?

Thanks for your attention.

Answer 1

What you are seeing is Wireshark trying to detect and decode the data stream. It makes its best guess what the application is and tries to decode it.

OFT2, for example, is a file transfer application. You can find details on it just a quick Google search away. You can also search for file signatures, which Wireshark uses to detect the application in use.