Googling a port and protocol leads to a terse description at best, and a linkfarm in the average case. Most protocols on assorted, unknown high ports contain little or no plaintext, and often if the IDS trips in the middle of a session I don't even see the session setup.
There are useful lists of file signatures denoting different filetypes. I've never seen something like this for protocols above the transport layer, besides perhaps the one built into Wireshark.
Does anyone know of a good information source for this?
Another option would be a machine learning classifier for network data. I've seen papers describing them, and seen projects to build one start, but never found one at a usable stage of development.