This is our old Q&A Site. Please post any new questions and answers at

i want to know about how port name resolution is done in wireshark? Directly using well known port numbers to match with the names or is there any other methods used for this purpose while decoding the port numbers ?


asked 18 Jan '11, 23:05

berkey's gravatar image

accept rate: 0%

Have a look at the file 'services' in your Wireshark installation.

# This is a local copy of the IANA port-numbers file.
# $Id: services 34645 2010-10-25 18:24:59Z morriss $
# Wireshark uses it to resolve port numbers into human readable
# service names, e.g. TCP port 80 -> http.
# It is subject to copyright and being used with IANA's permission:
# The original file can be found at:
permanent link

answered 18 Jan '11, 23:46

Jaap's gravatar image

Jaap ♦
accept rate: 14%

@Jaap, thanks for the answer +1, Do you have any idea how the source and destination is identified if the there is no syn seen, we can say if my traces includes partial ones...

(21 Jan '11, 13:39) berkey

Ports, hence port number name resolution aren't direction related. The concept of source and destination comes from their place in the protocol messages. For TCP, which you are referring to, it's the source port (tcp.srcport) and destination port (tcp.dstport).

(22 Jan '11, 01:27) Jaap ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 18 Jan '11, 23:05

question was seen: 6,941 times

last updated: 22 Jan '11, 01:27

p​o​w​e​r​e​d by O​S​Q​A