I need to know how does wireshark or any other program knows the protocol next from TCP. I mean, for instance:

  1. The Ethernet layer has a field named Type which carry the IPv04
  2. The Internet protocol has a filed named Protocol which identify the next TCP header
  3. The TCP header doesn't have any of this

But any way wireshark, chrome or any other program undertant that the protocol is HTTP or FTP or something else. Any idea of how this works?

Thanks, regards.


For the major services (web, mail, telnet, ssh, etc) it's done by convention: the "well known port numbers" were established essentially by documenting what everybody was using in 1972: "We would like to catalog other sockets which are supposed to be well-known, so we would appreciate having a note or phone call ..." RFC 322. Remember at that time it wasn't clear which services were going to be major. By 1994 it had evolved into part of the "Assigned Numbers" list, last published as RFC 1700. Even that got out of hand, so was replaced with an online registry. Wikipedia has a decent summary. Nowadays, most things which once upon a time might have had their own socket number, such as whois, would today be done by XML/HTTP or similar.

| improve this answer | |
  • really appreciate it :) – Luis A Jul 30 '18 at 6:45

Most often, the application protocol (next upper layer from TCP) is identified by TCP's destination port number. E.g. HTTP uses port 80, FTP uses port 21, SMTP uses port 25 by default.

| improve this answer | |

There is generally a well-known port associated with each service, for some services this will be a port number assigned by the IANA, for others it will be something picked by the service author. In the latter case there can of course be conflicts between different services but it's generally not too big a problem in practice since each server typically only runs a handful of services. Most client and server applications also provide a method to select a non-default port.

Normal client and server software just assumes that the other side will be talking the expected protocol. If it doesn't then the connection is likely to fail with some sort of error.

Scanning and sniffing tools must make an educated guess as to the protocol being used. Most protocols are fairly distinctive once you have a handful of packets.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.