Change protocol associated with port in wireshark

Solution 1:

If you go to Edit -> Preferences -> Protocols -> HTTP, you should find a list of ports that are considered to be HTTP. Add port 9191 to that list. I believe you have to re-start Wireshark and re-open your capture file or re-start your capture for this to take effect.

This is on the Windows version 1.0.3; it might be slightly different on other platforms. Obviously this isn't a generic way to alter the port to protocol mappings, but the authors of the http decoder seem to have recognized that people run it on many different ports.

Solution 2:

That's because it's only set up to decode it if one of the sides of the conversation is on port 9191.

_{(source: sysadmin1138.net)}

You need to set it so it reads, "TCP Both". That way it'll decode TCP/9191 traffic as HTTP if the source port is 9191 or if the destination port is 9191.

---

Solution 3:

sysadmin1138 and James F's responses are both correct. James' response is probably "more correct" in this case since changes to the HTTP protocol preferences are sticky between runs of Wireshark. In version 1.2.0 and above, you can quickly jump to protocol prefs by right-clicking on items in the packet detail (middle) pane.

(Disclosure: I'm the lead developer)

---

Solution 4:

In Decode At window use Both in front of TCP to decode packet using 9191 port number (source port or destination port) as HTTP.