If the XMPP servers that a connection has been made to are using the standard ports, you can filter on the following ports:
5222 TCP XMPP client connection (RFC 3920) Official 5223 TCP XMPP client connection over SSL Unofficial 5269 TCP XMPP server connection (RFC 3920) Official 5298 TCP UDP XMPP JEP-0174: Link-Local Messaging / Official XEP-0174: Serverless Messaging 8010 TCP XMPP File transfers Unofficial Apart from that you cannot determine what connection is being used by which protocol by looking at TCP connections. You would have to sniff the connections by using a packet sniffer (Wireshark). Wireshark does contain filters for protocols.