I'm wondering if there is a heuristic plug-in, software or other process for determining protocol when a non-standard TCP port is used.
Wireshark will decode packets based on the well-known port number. For example, TCP 80 will be decoded as HTTP. There is some level of flexibility, such as the ability to define TCP 8080 traffic as HTTP and to be decoded accordingly. My question surrounds decoding non-standard port numbers. You can use the "Decode As..." functionality to do this, provided that the protocol is known.
Below is a session with the server listening on TCP 4443 which is officially Individual Zone Solutions P/L Remote Mail Checking Protocol, for which there is no decode and I was pretty sure is not what it is:
I took a wild guess, based on the similarity of 443 and 4443 and did a "Decode As..." SSL and was rewarded with:
This worked, however it could be lots of guessing/trial and error. Since I can analyze the payload and most likely find clues as to the protocol, is there an automated method to do the same within Wireshark or another tool?