I need to know how does wireshark or any other program knows the protocol next from TCP. I mean, for instance:
But any way wireshark, chrome or any other program undertant that the protocol is HTTP or FTP or something else. Any idea of how this works?
Thanks, regards.
Services are distinguished by the port number, which is in the TCP header, and a given service (HTTP, FTP, TIME) will have a process on the server listening on a given port number. (Specifically, the connection is in LISTEN state, see RFC 768 Figure 6 on p23). In the same way as the client process knows which host to contact (typically because some human asked for it or configured it), it knows what the server's port number will be because it will be what's called a "well-known port number". The operating system knows these part of its configuration.
For the major services (web, mail, telnet, ssh, etc) the allocation was done by convention: the "well known port numbers" were established by documenting what everybody was using in 1972: "We would like to catalog other sockets which are supposed to be well-known, so we would appreciate having a note or phone call ..." RFC 322. Remember at that time it wasn't clear which services were going to be important, or indeed that the internet would grow the way it did. By 1994 it had evolved into part of the "Assigned Numbers" list, last published as RFC 1700. Even that got out of hand, so was replaced with an online registry. Wikipedia has a decent summary. Nowadays, most things which once upon a time might have had their own socket number, such as whois, would today be done by XML/HTTP or similar.
Within a given system, the port numbers might be hard-coded or looked up with an operating system specific mechanism. For example, the Berkeley sockets software, which was the model for most internet implementations, provides a getservbyname() library call, which normally looked things up a file /etc/services; other operating systems have analogous mechanisms.
Most often, the application protocol (next upper layer from TCP) is identified by TCP's destination port number. E.g. HTTP uses port 80, FTP uses port 21, SMTP uses port 25 by default.
There is generally a well-known port associated with each service, for some services this will be a port number assigned by the IANA, for others it will be something picked by the service author. In the latter case there can of course be conflicts between different services but it's generally not too big a problem in practice since each server typically only runs a handful of services. Most client and server applications also provide a method to select a non-default port.
Normal client and server software just assumes that the other side will be talking the expected protocol. If it doesn't then the connection is likely to fail with some sort of error.
Scanning and sniffing tools must make an educated guess as to the protocol being used. Most protocols are fairly distinctive once you have a handful of packets.
