When using tor,I sometimes also use wireshark to see if unexpected ip is connected or not. Is it less anonymous to use tor and wireshark at the same time?
And I noticed that protocols between my pc and entry nodes differs depending on them. They are tcp,tlsv1.2,pop,IMF and so on. Are they just judged by the port they are using? Whatever protocol wireshark shows,is it correct that users don't have to mind it? Or is it better to pick up entry node manually that uses port 80 or 443?
If I understand you correctly, you're sniffing the connection between your computer and the guard node. This doesn't make you less anonymous, because you know that you use this guard node and if any attacker watches your connection Wireshark doesn't play a role in what he can see or not see.
Different guard nodes use different ports. Wireshark looks at your /etc/services file (or an equivalent) to map the port number to a name. This is what you see in Wireshark. However if it prints POP, it is not really a POP connection, but just a TCP connection. So it doesn't matter what is printed there. It is just an information about what port is used.
Basically - no, but if you're behind a censoring network equipment and/or proxy server - you have to. 80 and 443 are the safest way, especially with obfs4 pluggable transport with port 443
