Wireshark · Wireshark-dev: [Wireshark-dev] regarding Wireshark's TCP plugin

[Selçuk Cevher <cevhers@xxxxxxxxx>]

Hi,

Does Wireshark's TCP plugin only
use port numbers or some other additional mechanisms to identify the application layer traffic ?

To me, using only port numbers does not make sense.

If it uses other mechanisms for traffic identification, what are these ?

For example, in case of POP3 and SMTP,  Is Wireshark capable of identifying the POP3 or SMTP traffic even if a mail client uses a server connection port other than 110 for POP3 and 25 for SMTP.

Thanks.