I am not sure if the title is the correct one. When transfering files over the network, in Wireshark, we see abbreviations like:

- PK -> Beginning of a file. Is it a compressed file?
- OFT2 -> Beginning of a file transfer.
- ELF -> DUMP?
- MZ -> Binary file?

I have several questions, and feel a little bit confused in this topic:

  1. Where can I find an extensive list of this abbreviations?
  2. Where are this abbreviations coming from? Is it a wireshark thing, is it a file system thing? Because it's on the app layer, is this a app thing?
  3. Can someone point me to the right direction to learn more about this topic?

Thanks for your attention.


What you are seeing is Wireshark trying to detect and decode the data stream. It makes its best guess what the application is and tries to decode it.

OFT2, for example, is a file transfer application. You can find details on it just a quick Google search away. You can also search for file signatures, which Wireshark uses to detect the application in use.

  • "File Signatures" was exactly what I was looking for. Thanks @RonTrunk
    – f4d0
    Feb 23 '18 at 20:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.