As @Sjoerd proposed in his answer you can look at the port number. But this does not help if it is not simple a TLS enabled protocol (i.e. smtps instead of smtp, ftps instead of ftp...) but if Bob is using a proxy server or VPN to tunnel the protocol.
In this case one could try to detect the protocol by flow analysis because different protocol have different traffic characteristics regarding which amount of data is sent at which time in which direction. And this behavior is visible from outside the TLS tunnel too.
For example both SMTP and FTP start similar in that the server first sends a short welcome message which is then followed by several small exchanges (i.e. USER, PASS, .. with FTP and EHLO, MAIL FROM, RCPT TO... with SMTP) which are then followed by a larger transfer from client to server with SMTP (i.e. the mail) and most times from server to client with FTP (directory listing). With HTTP instead the clients sends usually a small request (but noticeable larger than the commands within SMTP, FTP) while the server sends a much larger response back.
While it is not possible to be fully sure about the protocol spoken these manual heuristics already provide a way to classify the traffic. Classifying the traffic this way is also relevant outside of TLS because deeper traffic inspection just for classification is often two expensive and slow. If you just search for netflow traffic classification you will find lots of scientific papers and other information for further research.