How wireshark defines the bittorrent protocol?

edit

Could you describe the heuristic method in a little more detail?

Click the "heuristic analysis of the packet" link in @Jaap reply. It's 3 lines of code that read pretty easy.

The three lines say:

1. Length minimum 20 bytes
2. a byte with value 19
3. followed by a string "BitTorrent protocol"

But there are packages that do not meet these conditions, but are still defined as BitTorrent. I have attached a link to this comment where you can see an example of such a package.

https://ibb.co/YfqVMQ6

   if (tvb_captured_length(tvb) >= 20 &&
       tvb_get_guint8(tvb, 0) == 19 &&
       tvb_memeql(tvb, 1, (const guint8*)"BitTorrent protocol", 19) == 0) {
      conversation = find_or_create_conversation(pinfo);
      conversation_set_dissector(conversation, dissector_handle);

Is the packet in the screen shot part of a conversation that matches the protocol heuristics?

Check the bittorrent dissector preferences. The stated port range are the default port numbers. These are configurable, so it's impossible to tell what these were in the Wireshark session you made a screenshot from.

There are default ports in bittorrent dissector preferences. https://ibb.co/g4jZYmy

Are you going to share the capture file?

It can be seen in the Wiki sample capture. (Frame 4)

BITTORRENT.pcap (libpcap) Capture file of two torrent clients communicationg without DHT or peer exch.

(The wiki is having issues currently - get file from Gitlab version: https://gitlab.com/wireshark/wireshar...)
If you export frame 4 to a pcap and open, it will display as TCP and data.

Okay, for example https://drive.google.com/file/d/1NL5J....

Look, @Chuckc sent a link to an example of traffic. The fourth packet, which is defined as Unchoke, does not contain standard ports, and the payload length is less than 20, and there is no string "BitTorrent protocol". How is such a packet defined in Wireshark as BitTorrent?

This is where the power of 'conversations' comes in. Once it is established that a IP/protocol/port pair exchanges the bittorrent protocol a conversation is created (see code sample above) that causes the payloads of the packets exchanged between them to be handed off to the bittorrent dissector.

README.dissector:

2.2.1.11 The conversation_set_dissector function

This function sets the protocol dissector to be invoked whenever conversation parameters (addresses, port_types, ports, etc) are matched during the dissection of a packet.

A conversation is defined in frame 1 and the BitTorrent dissector is set for it.
Future frames (such as frame 4) that are part of the conversation then use the BitTorrent dissector.

That is, if it was detected that a pair of addresses started a BitTorrent conversation, then the following packets between them are perceived as potentially BitTorrent?