Explanation of port protocols in Wireshark?

Question

When using Wireshark you can display the packets with just the plain number of the port, or with a "transport layer name resolution" (via the View/Name Resolution menu, for example).

Unfortunately, the resolved name are often obscure: "sentinel", "snac", "cimtrak", "exapt-lmgr", "jamserverport", etc. There are literally hundreds of different such labels. I assume wireshark is looking inside the packet and somehow identifying the type of communication it is. There is no documentation of these lables (cimtrack, etc) that I can find in the Wireshark documentation.

How can I find out what these port labels mean?

Answer 1

How can I find out what these port labels mean?

With an incredible amount of historical research. :-)

"Transport layer name resolution" is done using a file generated from the data in the IANA Service Name and Transport Protocol Port Number Registry. That registry dates back to the 1980's, and has some not-well-documented registrations in it.

There has, I think, been discussion of having Wireshark not use the "services file" to resolve port numbers, and, for example, just check for a dissector registered for that port and, if one is found, use the name of the protocol that dissector dissectors.

(But you'd still get those labels with tcpdump....)