I need to know how does wireshark or any other program knows the protocol next from TCP. I mean, for instance:

  1. The Ethernet layer has a field named Type which carry the IPv04
  2. The Internet protocol has a filed named Protocol which identify the next TCP header
  3. The TCP header doesn't have any of this

But any way wireshark, chrome or any other program undertant that the protocol is HTTP or FTP or something else. Any idea of how this works?

Thanks, regards.

3 Answers 3


Services are distinguished by the port number, which is in the TCP header, and a given service (HTTP, FTP, TIME) will have a process on the server listening on a given port number. (Specifically, the connection is in LISTEN state, see RFC 768 Figure 6 on p23). In the same way as the client process knows which host to contact (typically because some human asked for it or configured it), it knows what the server's port number will be because it will be what's called a "well-known port number". The operating system knows these part of its configuration.

For the major services (web, mail, telnet, ssh, etc) the allocation was done by convention: the "well known port numbers" were established by documenting what everybody was using in 1972: "We would like to catalog other sockets which are supposed to be well-known, so we would appreciate having a note or phone call ..." RFC 322. Remember at that time it wasn't clear which services were going to be important, or indeed that the internet would grow the way it did. By 1994 it had evolved into part of the "Assigned Numbers" list, last published as RFC 1700. Even that got out of hand, so was replaced with an online registry. Wikipedia has a decent summary. Nowadays, most things which once upon a time might have had their own socket number, such as whois, would today be done by XML/HTTP or similar.

Within a given system, the port numbers might be hard-coded or looked up with an operating system specific mechanism. For example, the Berkeley sockets software, which was the model for most internet implementations, provides a getservbyname() library call, which normally looked things up a file /etc/services; other operating systems have analogous mechanisms.

  • really appreciate it :)
    – Luis A
    Commented Jul 30, 2018 at 6:45

Most often, the application protocol (next upper layer from TCP) is identified by TCP's destination port number. E.g. HTTP uses port 80, FTP uses port 21, SMTP uses port 25 by default.

  • Thanks for your answer, but I am a bit confused, because what if I were to SSH into port 80 - how does the server identify that I am using the SSH protocol and not HTTP? Is there some way the web server can identify the protocol based on the data format itself?
    – Maslin
    Commented Jan 29, 2021 at 11:10
  • @Maslin SSH uses its own TCP port 22. A web server (Apache, nginx, ...) doesn't understand SSH, FTP or anything else but HTTP.
    – Zac67
    Commented Jan 29, 2021 at 11:20
  • that's where the confusion comes from - how does the web server know that incoming packets are in a SSH format and not HTTP?
    – Maslin
    Commented Jan 31, 2021 at 12:06
  • The source sends segments belonging to an SSH session to port 22 and those for HTTP to port 80 (or HTTPS to port 443). Those segments are then passed to the according process by the destination host stack. The actual web server never sees anything related to SSH.
    – Zac67
    Commented Jan 31, 2021 at 12:11

There is generally a well-known port associated with each service, for some services this will be a port number assigned by the IANA, for others it will be something picked by the service author. In the latter case there can of course be conflicts between different services but it's generally not too big a problem in practice since each server typically only runs a handful of services. Most client and server applications also provide a method to select a non-default port.

Normal client and server software just assumes that the other side will be talking the expected protocol. If it doesn't then the connection is likely to fail with some sort of error.

Scanning and sniffing tools must make an educated guess as to the protocol being used. Most protocols are fairly distinctive once you have a handful of packets.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.