How does wireshark determine the application data protocol when the message is TLS encrypted?

edit

Yes, that's correct. From packet-mqtt.c, you can see the 2 port registrations being done, one for unencrypted MQTT traffic over TCP and the other for encrypted MQTT traffic over TLS:

1698 /*
1699  *  Dissector Handoff
1700  */
1701 void proto_reg_handoff_mqtt(void)
1702 {
1703   dissector_add_uint_with_preference("tcp.port", MQTT_DEFAULT_PORT, mqtt_handle);
1704   ssl_dissector_add(MQTT_SSL_DEFAULT_PORT, mqtt_handle);
1705 }

Here are the #defines that go with the code snippet above:

:
41 
42 #define MQTT_DEFAULT_PORT     1883 /* IANA registered under service name as mqtt */
43 #define MQTT_SSL_DEFAULT_PORT 8883 /* IANA registered under service name secure-mqtt */

Okay cool, thanks for the confirmation :)