Wireshark-dev: [Wireshark-dev] regarding Wireshark's TCP plugin
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Selçuk Cevher <cevhers@xxxxxxxxx>
Date: Tue, 14 Jul 2009 15:59:40 +0300
Hi,

Does Wireshark's TCP plugin only use port numbers or some other additional mechanisms to identify the application layer traffic ?

To me, using only port numbers does not make sense.

If it uses other mechanisms for traffic identification, what are these ?

For example, in case of POP3 and SMTP,  Is Wireshark capable of identifying the POP3 or SMTP traffic even if a mail client uses a server connection port other than 110 for POP3 and 25 for SMTP.

Thanks.