What does Network Monitor use to identify network traffic going to a nonstandard port?

What does Network Monitor use to identify network traffic going to a nonstandard port?

A.
Protocol signature

B.
The originating domain

C.
Total packet size

D.
Either UDP or TCP