Protocol Numbers, EtherTypes & Flags
IP protocol numbers, Ethernet EtherTypes, ICMP types and TCP flags in one searchable place - the values that appear in ACLs and packet captures.
Result
IP protocol numbers
| Number | Protocol | Notes |
|---|---|---|
| 1 | ICMP | Internet Control Message Protocol - ping, unreachables, PMTUD. |
| 2 | IGMP | Multicast group management. |
| 4 | IPv4 | IPv4 encapsulation (IP-in-IP). |
| 6 | TCP | Transmission Control Protocol. |
| 17 | UDP | User Datagram Protocol. |
| 41 | IPv6 | IPv6 encapsulation - 6in4 tunnels. |
| 46 | RSVP | Resource Reservation Protocol, used by MPLS TE. |
| 47 | GRE | Generic Routing Encapsulation. |
| 50 | ESP | IPsec Encapsulating Security Payload - must be permitted for IPsec. |
| 51 | AH | IPsec Authentication Header - breaks through NAT. |
| 58 | ICMPv6 | Essential for IPv6: never block it wholesale. |
| 88 | EIGRP | Cisco EIGRP. |
| 89 | OSPF | OSPFv2 and OSPFv3. |
| 103 | PIM | Protocol Independent Multicast. |
| 112 | VRRP | Virtual Router Redundancy Protocol (also CARP). |
| 115 | L2TP | Layer 2 Tunnelling Protocol. |
| 132 | SCTP | Stream Control Transmission Protocol - used in mobile core networks. |
| 137 | MPLS-in-IP | MPLS encapsulated in IP. |
EtherTypes
| EtherType | Protocol |
|---|---|
| 0x0800 | IPv4 |
| 0x0806 | ARP |
| 0x8035 | RARP |
| 0x8100 | 802.1Q VLAN tag |
| 0x86DD | IPv6 |
| 0x8808 | Ethernet flow control (PAUSE) |
| 0x8809 | LACP / slow protocols |
| 0x8847 | MPLS unicast |
| 0x8848 | MPLS multicast |
| 0x8863 | PPPoE discovery |
| 0x8864 | PPPoE session |
| 0x88A8 | 802.1ad QinQ |
| 0x88CC | LLDP |
| 0x88E5 | MACsec |
| 0x8892 | PROFINET |
| 0x88F7 | PTP (IEEE 1588) |
ICMP types (IPv4)
| Type | Message | Notes |
|---|---|---|
| 0 | Echo Reply | Ping response. |
| 3 | Destination Unreachable | Code 4 is "fragmentation needed" - blocking it breaks PMTUD. |
| 5 | Redirect | Better first hop available. Usually disabled. |
| 8 | Echo Request | Ping. |
| 11 | Time Exceeded | TTL hit zero - this is what makes traceroute work. |
| 12 | Parameter Problem | Malformed header. |
| 13/14 | Timestamp | Legacy; often blocked as an information leak. |
TCP flags
| Flag | Bit | Meaning |
|---|---|---|
| SYN | 0x02 | Start a connection. |
| ACK | 0x10 | Acknowledges data. Set on everything after the first packet. |
| FIN | 0x01 | Graceful close. |
| RST | 0x04 | Abrupt reset - refused connection or a stale session. |
| PSH | 0x08 | Deliver to the application immediately. |
| URG | 0x20 | Urgent pointer valid. Effectively obsolete. |
| ECE/CWR | 0x40/0x80 | Explicit Congestion Notification signalling. |
About Protocol Numbers, EtherTypes & Flags
Protocol numbers identify what sits inside an IP packet; EtherTypes identify what sits inside an Ethernet frame. Both appear in ACLs, packet captures and firewall rules, and neither is memorable.
How the fields nest
An Ethernet frame declares its payload with a 16-bit EtherType: 0x0800 for IPv4, 0x86DD for IPv6, 0x8100 for a VLAN tag. When a VLAN tag is present the real EtherType sits four bytes further in, which is why a capture filter written for untagged traffic silently misses tagged frames. Inside the IP header, the 8-bit protocol field names the next layer: 6 for TCP, 17 for UDP, 47 for GRE. IPv6 replaces it with a Next Header chain, so extension headers must be walked before the transport header is reached — a detail that breaks naive hardware ACLs.
Never block ICMPv6
IPv4 tolerates aggressive ICMP filtering, badly. IPv6 does not: neighbour discovery, router advertisement and PMTUD all run over ICMPv6, so blocking protocol 58 breaks address resolution itself. RFC 4890 sets out what may safely be filtered - the answer is much less than people assume.
Common use cases
- Writing a firewall rule that permits a GRE or IPsec tunnel.
- Decoding an EtherType from a packet capture.
- Explaining why blocking ICMP type 3 code 4 causes intermittent hangs.
Edge cases and gotchas
- ICMP type 3 code 4 carries path MTU information - filtering it creates black holes.
- EtherType 0x8100 indicates a VLAN tag, so the real payload type is four bytes further in.