I want to understand how Wireshark identifies the L7 applications correctly which are not running on standard port?

asked 2018-08-14 08:32:15 +0000

This post is a wiki. Anyone with karma >750 is welcome to improve it.

I want to understand how Wireshark identifies the L7 applications correctly? I had my web server listening to port 8888, and I did wget http:server:8888 and got response. Wireshark correctly identified the application as http. How this is achieved?

edit retag flag offensive close merge delete

add a comment

1 Answer

Sort by » oldest newest most voted

answered 2018-08-14 09:03:55 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23790 ●4 ●950 ●227 https://www.wireshark.org

Heuristic dissectors.

A heuristic dissector, such as http, registers for all TCP traffic, and if there no dissector has registered for the port the traffic has been received on, then the TCP dissector calls each heuristic dissector in turn, and each dissector inspects the traffic and decides if it "looks right", and if so dissects it, else declines and passes the opportunity to the next dissector.

See README.heuristic for more info.

edit flag offensive delete link

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2018-08-14 08:32:15 +0000

Seen: 334 times

Last updated: Aug 14 '18

Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.

I want to understand how Wireshark identifies the L7 applications correctly which are not running on standard port? edit

1 Answer