How to get application layer protocol?

Question

Traffic analysis

Hello, I am writing a sniffer. Interested in how to get the application layer protocol (name) of the intercepted packet. Which way to climb?
You need to make a correspondence table "package metrics" - the name of the application layer.

Answer 1

As a first approximation - by TCP / UDP port of the server side ( IANA Assigned Numbers ).
If you need higher accuracy, look towards signatures and heuristics.
Nobody prevents the client and the server from "agreeing" on the use of a non-standard port for any application protocol.