I'm wondering if there is a heuristic plug-in, software or other process for determining protocol when a non-standard TCP port is used.

Wireshark will decode packets based on the well-known port number. For example, TCP 80 will be decoded as HTTP. There is some level of flexibility, such as the ability to define TCP 8080 traffic as HTTP and to be decoded accordingly. My question surrounds decoding non-standard port numbers. You can use the "Decode As..." functionality to do this, provided that the protocol is known.

Below is a session with the server listening on TCP 4443 which is officially Individual Zone Solutions P/L Remote Mail Checking Protocol, for which there is no decode and I was pretty sure is not what it is:

TCP decode

I took a wild guess, based on the similarity of 443 and 4443 and did a "Decode As..." SSL and was rewarded with:

enter image description here

This worked, however it could be lots of guessing/trial and error. Since I can analyze the payload and most likely find clues as to the protocol, is there an automated method to do the same within Wireshark or another tool?

2 Answers 2


You need software that does DPI (Deep Packet Inspection). Some companies have made standard rules for some protocols, where in a TCP or UDP packet or some sequence, it can identify the protocol or application that is running.

This kind of application realizes an analysis of Layer 7 of a packet, matching the packet content with a huge rules database.

Like @ojs said, you can try with nDPI from ntop, test it and see the results.

Cisco also has its own database that can be used with the OPNManager, but requires a license.

  • ndpi might work.
    – ojs
    Dec 16, 2015 at 23:09
  • @ojs or Orlando - I haven't tested but that looks promising. Formulate as an answer and I can accept it. Jun 15, 2016 at 18:50

ther is many ways to do so

  1. to use netstat and is extensions in the CMD . it will give you all you want .

examples in images

enter image description here

enter image description here

a good tutorial for netstate commands NETSTATE COM

i know it is a very hard way to do so but it is free of charge

  1. SolarWinds Response Time Viewer for Wireshark
    it is the revers engineering of you question . it will list the applications used in you session and all related details


enter image description here

  1. other wise you will need to bay for monitoring tool include DPI features (i.e. solarwinds , manageenginee )
  • Thanks for the detailed answer. 1. I am very aware of netstat, however all I have is a capture. Also, in my case it would show TCP [someapp.exe] which doesn't tell me that it's SSL. 2. It would be interesting to confirm, but I'm pretty sure that is determining application by port as well. 3. Would be nice as an open source plugin/tool. Sep 17, 2015 at 20:29
  • it sound like you need plugin work as a port awareness to each captured packet to identify its type (HTTP ,HTTPS etc)
    – Gadeliow
    Sep 17, 2015 at 21:42
  • the nearest way to perform what you need is to use the solarwinds RTV with wiresharke . first capture the traffic by wireshark as you did , save your capture , apply it to the RTV , you will get the list of application contained in you capture and then you can export packets done by certain application and reopen it with wireshark . this way you can get info even on the unknown TCP port number APP ()
    – Gadeliow
    Sep 17, 2015 at 22:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.