# Protocol number

> Source: Courseiva IT Certification Glossary — https://courseiva.com/glossary/protocol-number

## Quick definition

A protocol number is a small number assigned to each network protocol, like a code that tells the system what kind of data it is handling. When data travels across a network, the protocol number helps the receiving device understand whether the data belongs to TCP, UDP, ICMP, or another protocol. This allows computers to process information correctly without confusion.

## Simple meaning

Imagine you work at a large post office that receives millions of letters every day. Each letter comes in an envelope, but the envelope does not say what is inside it could be a bill, a birthday card, a legal document, or a package slip. To sort the letters quickly, the post office uses color-coded stickers. A red sticker means the letter is a bill. A blue sticker means it is a birthday card. A green sticker means it is a legal document. These stickers tell the sorting machine exactly what to do with each piece of mail without opening the envelope. In the world of computer networking, a protocol number works exactly like that color-coded sticker. Every piece of data sent over the internet is wrapped in something called an IP packet, which is like an envelope. Inside that envelope, there is a field called the protocol number. This number tells the receiving computer what kind of data is inside. For example, if the protocol number is 6, the computer knows the data uses TCP, which is used for reliable communication like loading a web page or sending an email. If the number is 17, the computer knows the data uses UDP, which is used for faster but less reliable communication like streaming video or playing online games. If the number is 1, the computer knows the data is an ICMP message, which is used for diagnostic tools like ping. Without the protocol number, the receiving computer would have to guess what to do with the data, which would cause errors, crashes, or security vulnerabilities. The protocol number is a tiny but essential part of the internet that ensures every device can talk to any other device in a consistent and predictable way. It is one of the reasons the internet works smoothly even though billions of devices are connected at the same time.

## Technical definition

A protocol number is an 8-bit field in the IPv4 header and a similar field in the IPv6 header called the Next Header field. This field identifies the transport layer protocol that is encapsulated within the IP packet. The protocol number is defined and assigned by the Internet Assigned Numbers Authority (IANA), which maintains a master list of all protocol numbers used across the internet. The field is placed directly in the IP header so that the receiving device can immediately know which protocol handler should process the packet's payload.

In IPv4, the Protocol field is located at byte 9 of the IP header and occupies 8 bits. This means it can represent values from 0 to 255. Each value corresponds to a specific protocol. The most commonly seen protocol numbers in IT certification exams are 1 for ICMP, 6 for TCP, and 17 for UDP. Other important protocol numbers include 2 for IGMP, 89 for OSPF, and 47 for GRE. When a router or host receives an IP packet, it reads the Protocol field and passes the payload to the appropriate transport layer protocol based on that number. This process is called demultiplexing.

In IPv6, the equivalent field is called the Next Header field. It serves the same purpose but also allows for extension headers, which are additional headers that can be chained together. The Next Header field tells the device what follows the current header, which could be another extension header or the upper-layer protocol. The values for the Next Header field are the same as the IPv4 Protocol field values.

The protocol number is distinct from port numbers. Port numbers (like port 80 for HTTP or port 443 for HTTPS) are used by TCP and UDP to identify specific applications or services. The protocol number identifies the protocol itself, not the application. This distinction is critical for understanding how network traffic is processed. For example, a packet with protocol number 17 is handed to UDP, and then UDP uses its port number to decide which application should receive the data.

Real-world implementations rely on protocol numbers in operating system kernels, network drivers, firewalls, and intrusion detection systems. Firewalls often filter traffic based on protocol numbers, allowing or blocking entire protocol families. For instance, a firewall might allow ICMP (protocol 1) for diagnostics but block all other protocols except TCP and UDP to reduce the attack surface. Understanding protocol numbers is essential for configuring access control lists, network security policies, and troubleshooting connectivity issues.

## Real-life example

Think of a large office building with a central mailroom on the ground floor. Every day, thousands of packages arrive for different departments. The mailroom workers cannot just leave the packages in a pile they need to sort them quickly and send them to the right place. To make sorting efficient, each package has a colored sticker. A yellow sticker means the package goes to the accounting department. A blue sticker means it goes to marketing. A red sticker means it goes to human resources. The sticker tells the mailroom exactly which department should handle the package, without the mailroom needing to open it or read the contents.

In this analogy, the office building is a computer network, and the mailroom is the network interface card and operating system. The packages are IP packets arriving from the internet. The colored stickers are the protocol numbers. When a package arrives, the mailroom worker looks at the sticker and immediately knows which department should handle it. The yellow sticker is TCP, the blue sticker is UDP, and the red sticker is ICMP. Each department has different procedures. The accounting department (TCP) is very careful, checks each document twice, and sends confirmations back. The marketing department (UDP) works fast, sends out flyers quickly, and does not worry if a few get lost. The human resources department (ICMP) only sends short messages like ping to check if an employee is in the building.

Now, imagine what would happen if the mailroom did not have colored stickers. The workers would have to open each package to see what it was, guess where it should go, and hope they were correct. Some packages might go to the wrong department, causing delays and confusion. Some might be thrown away by mistake. The colored sticker protocol number solves this problem by providing a simple, standard, and universally understood way to sort traffic. In the same way, protocol numbers ensure that every device on the internet can correctly process the data it receives, even if the data comes from a completely different type of device made by a different manufacturer.

## Why it matters

Protocol numbers are a foundational concept in networking, and understanding them is critical for several practical reasons. First, they enable the separation of different protocols at the network layer. Without protocol numbers, every device would need to inspect the payload of every packet to determine what protocol is being used. That process would be slow, inefficient, and error-prone. Protocol numbers allow for fast demultiplexing, so a router or host can instantly hand off the packet to the correct protocol handler.

Second, protocol numbers are essential for network security. Firewalls, intrusion detection systems, and access control lists rely on protocol numbers to decide which traffic to allow or block. For example, a network administrator might create a rule to allow TCP traffic (protocol 6) but block all other protocols except for specific exceptions like ICMP (protocol 1) for network diagnostics. If you are configuring a firewall rule, you need to know which protocol number corresponds to which protocol. A mistake in the protocol number can accidentally block all web traffic or leave the network vulnerable to attacks.

Third, protocol numbers are important for troubleshooting network issues. When a network engineer uses a tool like Wireshark to capture and analyze packets, the protocol number is one of the first fields to check. If a packet has an unexpected protocol number, it can indicate misconfiguration, a bug, or even malicious activity. For example, if you see a packet with protocol number 47 (GRE) coming from an unknown source, it might be an attempt to tunnel traffic through your network.

Fourth, protocol numbers are part of the IANA registry, which means they are globally standardized. This standardization is what allows devices from different vendors, running different operating systems, to communicate reliably. Whether you are using a Windows laptop, a Linux server, or a Cisco router, they all understand the same protocol numbers. This interoperability is the backbone of the internet.

Fifth, protocol numbers are increasingly relevant in cloud infrastructure and software-defined networking. When configuring virtual networks in AWS, Azure, or Google Cloud, you often need to specify protocol numbers in security group rules or network ACLs. A solid understanding of protocol numbers helps cloud architects design secure and efficient virtual networks.

## Why it matters in exams

Protocol numbers are a staple of general IT certification exams, including CompTIA Network+, CompTIA Security+, Cisco CCNA, and many vendor-specific network certifications. In CompTIA Network+ (N10-008 or N10-009), the exam objectives explicitly include the identification of protocols by their protocol numbers. You may be asked to match protocol numbers to their corresponding protocols, or to interpret a packet capture and identify which protocol is being used based on the protocol number field. Questions often ask: Which protocol uses protocol number 6? Which protocol uses protocol number 17? Which protocol uses protocol number 1?

In Cisco CCNA (200-301), protocol numbers appear in the context of IPv4 and IPv6 headers. You need to know that the Protocol field in IPv4 is an 8-bit field and that it identifies the next-level protocol. CCNA exam questions may ask you to identify the protocol number for OSPF (89), EIGRP (88), or GRE (47) when configuring routing protocols or VPNs. You might also encounter protocol numbers when working with access control lists because ACLs can filter traffic based on protocol numbers.

In CompTIA Security+ (SY0-601 or SY0-701), protocol numbers are relevant for understanding how firewalls and network security devices filter traffic. Security+ exam questions might present a scenario where a firewall is configured to block all traffic except TCP and UDP, and you need to identify which protocol numbers are being allowed. Or you may be asked about the purpose of the Protocol field in an IP packet and how it relates to security policies.

Exam questions also test the distinction between protocol numbers and port numbers. A common question format gives you a scenario with a packet capture and asks: What protocol is being used? To answer, you look at the protocol number field, not the port numbers. For example, if the Protocol field shows 1, the protocol is ICMP, regardless of the source or destination ports. Understanding this distinction is a common exam objective.

To prepare, memorize the key protocol numbers: 1 (ICMP), 6 (TCP), 17 (UDP), 89 (OSPF), 88 (EIGRP), and 47 (GRE). Also know that protocol numbers are assigned by IANA and that the range is 0-255. Practice reading IP headers and identifying the protocol number field. Being comfortable with these details will help you answer both straightforward and tricky exam questions.

## How it appears in exam questions

Protocol number questions appear in several common formats across IT certification exams. One of the most frequent patterns is the identification question. You will be given a list of protocols and a list of numbers and asked to match them. For example: Which protocol number corresponds to TCP? The answer is 6. Another variation shows a packet capture or a diagram of an IP header with the Protocol field highlighted. You must identify the protocol based on the number shown.

Scenario questions are also common. A typical scenario might describe a network administrator troubleshooting slow performance. They capture traffic and notice a large number of packets with protocol number 1. The question asks: What type of traffic is causing the issue? The answer is ICMP, which is often used by ping and traceroute. Another scenario might involve a firewall configuration. The administrator creates a rule that allows traffic with protocol number 17 only. You need to identify that this permits UDP traffic, and explain which applications might be affected.

Configuration questions appear in Cisco CCNA exams. For example: You need to configure an access control list that permits OSPF traffic. Which protocol number should you use in the ACL statement? The answer is 89. Or you might be asked to interpret a router configuration that includes a permit statement with a protocol number and determine what traffic is being allowed.

Troubleshooting questions often involve protocol numbers indirectly. For instance, a network engineer notices that ping works but web browsing fails. The packet capture reveals that TCP packets (protocol 6) are being dropped at a firewall, while ICMP packets (protocol 1) pass through. The question asks: What is the most likely cause? The answer is that the firewall is blocking TCP traffic. Understanding protocol numbers helps you diagnose which layer or protocol is failing.

Architecture questions test your understanding of where protocol numbers fit in the OSI or TCP/IP model. You might be asked: At which layer does the protocol number field exist? The answer is the Network layer (Layer 3) in the OSI model. Another question might ask: What is the purpose of the Protocol field in the IP header? The answer is to identify the next-layer protocol (e.g., TCP, UDP, ICMP).

Finally, comparison questions ask you to differentiate protocol numbers from port numbers. For example: What is the difference between a protocol number and a port number? You need to explain that a protocol number identifies the transport protocol, while a port number identifies the application within that protocol. Knowing this distinction is critical for avoiding common mistakes.

## Example scenario

An IT help desk technician receives a call from a user who cannot access the internet. The technician opens a command prompt and pings the company's web server to check basic connectivity. The ping command fails, showing 'Request timed out.' The technician then tries to browse to a website using a web browser, which also fails. The technician suspects a firewall issue. They log into the firewall and see a rule that blocks all traffic except for protocol number 1. The technician realizes that ICMP traffic is allowed, which is why ping works in theory, but TCP traffic is blocked, which is why web browsing fails. The technician corrects the firewall rule to allow protocol number 6, and web access is restored for the user.

In this scenario, the protocol number is the key to understanding the problem. Protocol number 1 corresponds to ICMP, which is used by the ping command. Protocol number 6 corresponds to TCP, which is used by web browsing. The firewall was configured to allow only ICMP traffic, inadvertently blocking TCP. By recognizing the protocol numbers, the technician could quickly identify and fix the misconfiguration.

## Common mistakes

- **Mistake:** Thinking that protocol numbers and port numbers are the same thing.
  - Why it is wrong: Protocol numbers identify the transport layer protocol (like TCP or UDP), while port numbers identify the specific application or service (like HTTP on port 80 or DNS on port 53). They serve different purposes and exist in different fields of a packet.
  - Fix: Remember: protocol numbers are in the IP header and tell you what protocol to use. Port numbers are in the TCP or UDP header and tell you which application to send the data to.
- **Mistake:** Assuming that protocol number 17 is always used for streaming or real-time traffic only.
  - Why it is wrong: Protocol number 17 means UDP, which is a transport protocol. UDP is used for many things besides streaming, including DNS queries, DHCP, VoIP, and online gaming. UDP is connectionless and fast, but it does not guarantee delivery.
  - Fix: Learn the common protocols that use UDP: DNS, DHCP, TFTP, SNMP, and streaming media. Understand that UDP is not only for streaming.
- **Mistake:** Confusing the protocol number for ICMP (1) with the ICMP type and code fields.
  - Why it is wrong: ICMP has its own types (like Echo Request, Echo Reply) and codes, which are separate from the protocol number. The protocol number identifies the packet as ICMP, but the type and code give more detail about the ICMP message. They are not interchangeable.
  - Fix: Protocol number = 1 means the packet is ICMP. Inside the ICMP header, there are Type and Code fields that specify exactly which ICMP message it is, such as Echo Request (type 8, code 0) or Destination Unreachable (type 3, code 0).
- **Mistake:** Forgetting that protocol numbers are universally assigned by IANA and are not configurable by users.
  - Why it is wrong: Some learners think they can change or define custom protocol numbers for their own use. Protocol numbers are standardized and managed by IANA. Changing them would break interoperability with other devices.
  - Fix: Protocol numbers are fixed standards. You do not configure them; you use them as defined. The only exception is for experimental purposes, but that is not relevant for certification exams.
- **Mistake:** Believing that protocol number 6 (TCP) is the most common and all other protocols are rare.
  - Why it is wrong: While TCP is very common for web, email, and file transfer, UDP (17) is also extremely common for DNS, DHCP, streaming, and VoIP. ICMP (1) is used for diagnostics. OSPF (89) and EIGRP (88) are critical for routing. Many protocols are in regular use.
  - Fix: Study a short list of the most important protocol numbers: 1 (ICMP), 6 (TCP), 17 (UDP), 47 (GRE), 88 (EIGRP), 89 (OSPF), and possibly 2 (IGMP). Know what each does.

## Exam trap

An exam question shows a packet capture with a Protocol field value of 6 and a destination port of 443. The question asks: 'What transport layer protocol is being used?' The learner sees port 443 and immediately answers 'TLS' or 'HTTPS', which is incorrect because the protocol number is what identifies the transport protocol. Always read the question carefully. If the question asks for the transport layer protocol, look at the Protocol field in the IP header. A value of 6 means TCP. Port numbers are irrelevant for identifying the transport protocol. Memorize the main protocol numbers and remember that TCP and UDP are transport layer protocols, while HTTP, HTTPS, and TLS are application layer protocols.

## Commonly confused with

- **Protocol number vs Port number:** A protocol number identifies the transport layer protocol (e.g., TCP, UDP, ICMP), while a port number identifies the specific application or service within that protocol (e.g., port 80 for HTTP, port 443 for HTTPS). They exist in different headers and serve different purposes. (Example: A packet with protocol number 6 and destination port 53 uses TCP (protocol 6) for DNS (port 53). The protocol number tells the system it is TCP, and the port number tells it the data is for the DNS application.)
- **Protocol number vs Ethernet type (EtherType):** The EtherType field in an Ethernet frame identifies the protocol encapsulated in the frame, such as IPv4 (0x0800) or IPv6 (0x86DD). The protocol number, on the other hand, identifies the protocol inside the IP packet itself. EtherType works at layer 2, while protocol numbers work at layer 3. (Example: An Ethernet frame has an EtherType of 0x0800, meaning the payload is an IPv4 packet. Inside that IPv4 packet, the Protocol field shows 6, meaning the payload is TCP. The EtherType tells you it is IP, and the protocol number tells you it is TCP.)
- **Protocol number vs ICMP type and code:** The ICMP type and code fields are part of the ICMP header and provide specific details about the ICMP message, such as Echo Request (type 8) or Destination Unreachable (type 3). The protocol number (1) simply identifies the packet as ICMP. The type and code give more granular information. (Example: A packet has protocol number 1, meaning it is ICMP. The ICMP header then has type 8 and code 0, which means it is an Echo Request (ping). Without the type and code, you would know it is ICMP but not what kind of ICMP message.)
- **Protocol number vs Application protocol:** An application protocol like HTTP, FTP, or SMTP operates at the application layer and uses TCP or UDP as its transport. The protocol number identifies the transport protocol, not the application protocol. HTTP uses TCP, but the protocol number is still 6, not a separate number for HTTP. (Example: When you visit a website, the protocol number 6 indicates TCP is used. The port number 80 indicates HTTP. The protocol number does not tell you it is HTTP; it tells you the transport is TCP.)

## Step-by-step breakdown

1. **Data is generated by an application** — An application like a web browser creates data that needs to be sent to a remote server. The browser uses HTTP, which is an application layer protocol. The application layer passes the data down to the transport layer for transmission.
2. **Transport layer encapsulates the data** — The transport layer chooses a protocol, typically TCP or UDP. TCP adds a header that includes source and destination port numbers. UDP adds a header with similar port numbers. The transport layer then passes the segment or datagram down to the network layer.
3. **Network layer creates the IP packet** — The network layer (IP) creates an IP packet. It adds an IP header that includes source and destination IP addresses. Critically, it also adds the Protocol field. If the data came from TCP, the Protocol field is set to 6. If it came from UDP, it is set to 17. If it came from ICMP, it is set to 1.
4. **The IP packet is sent across the network** — The IP packet travels across routers and switches to its destination. Each router reads the destination IP address to forward the packet but does not need to look at the Protocol field unless it is configured to filter based on protocol numbers.
5. **Destination device receives the packet** — The destination device's network interface receives the IP packet. The operating system extracts the IP header and reads the Protocol field. This field tells the OS which transport layer protocol handler should process the payload.
6. **Demultiplexing occurs** — Based on the protocol number, the OS passes the payload to the correct protocol module. If the number is 6, the payload goes to the TCP module. If it is 17, it goes to the UDP module. If it is 1, it goes to the ICMP module.
7. **Transport layer processes the data** — The transport layer module (TCP or UDP) reads the port numbers from its header to determine which application should receive the data. The data is then passed up to the application layer, where the application processes it.

## Practical mini-lesson

Let us explore protocol numbers in a hands-on way. Imagine you are a network administrator responsible for a small company's firewall. You need to configure the firewall to allow web traffic and DNS queries, but block all other traffic. To do this correctly, you must understand protocol numbers.

First, identify the protocols you want to allow. Web traffic uses TCP (protocol number 6) on port 80 (HTTP) and port 443 (HTTPS). DNS queries typically use UDP (protocol number 17) on port 53, though DNS can also use TCP for zone transfers. So, you need to allow protocol numbers 6 and 17. However, you do not want to allow all TCP and UDP traffic, because that would include many other services like SSH, FTP, and Telnet, which you might want to block. So you combine protocol numbers with port numbers in your firewall rules. For example, you create a rule: permit protocol 6 from any to any port 80 and port 443. Then create another rule: permit protocol 17 from any to any port 53. This combination gives you fine-grained control.

But what about ICMP? ICMP (protocol number 1) is useful for diagnostics like ping and traceroute. You might decide to allow ICMP within your internal network but block it from the internet to prevent certain types of attacks. You would create a rule that permits protocol 1 only from your internal IP range.

Now consider a security breach. An attacker might try to tunnel traffic using GRE (protocol number 47) to bypass your firewall. If you have not explicitly allowed GRE, your firewall should block it by default. If you see a sudden increase in packets with protocol number 47 in your logs, you should investigate immediately.

In practice, network professionals use tools like Wireshark to inspect protocol numbers in real traffic. When you capture packets, you can filter by protocol number using expressions like ip.proto == 6 to see only TCP packets. This helps you isolate traffic for analysis. Understanding protocol numbers also helps you read and write access control lists on routers and firewalls. For example, in Cisco IOS, an ACL entry might look like: access-list 100 permit tcp any any eq 80. The keyword 'tcp' tells the router to use protocol number 6. You could also write: access-list 100 permit 6 any any eq 80, though the keyword is easier to read.

What can go wrong? A common misconfiguration is using the wrong protocol number in a firewall rule. For instance, if you mistakenly use protocol number 17 (UDP) instead of 6 (TCP) for web traffic, your web server will never receive the TCP SYN packets, and users will not be able to browse the site. Another risk is forgetting to allow ICMP, which can break network monitoring tools. Always double-check your protocol numbers when writing firewall rules.

Connecting to broader IT concepts: Protocol numbers are part of the OSI model's Network layer. They work alongside other layer 3 concepts like IP addressing, routing, and fragmentation. They also interact with layer 4 protocols (TCP, UDP) and layer 7 applications. A solid grasp of protocol numbers helps you understand the entire data flow from application to wire and back again.

## Commands

```
show ip access-lists
```
Displays all configured IP access lists, including the protocol number (or name) used in each rule. For example, an entry might show 'permit tcp any any' which is equivalent to protocol 6.

```
tcpdump -i eth0 ip proto 6
```
Captures only TCP packets on interface eth0. The 'ip proto 6' filter specifies protocol number 6. This is a quick way to see only TCP traffic during troubleshooting.

```
access-list 101 deny icmp any any
```
Creates an ACL rule that denies all ICMP traffic. The keyword 'icmp' is used instead of the protocol number 1. This rule blocks ping requests and replies.

```
wireshark -Y "ip.proto == 17"
```
In Wireshark, this display filter shows only packets with protocol number 17 (UDP). Useful for isolating DNS or VoIP traffic for analysis.

## Troubleshooting clues

- **undefined** — symptom: undefined. undefined
- **undefined** — symptom: undefined. undefined
- **undefined** — symptom: undefined. undefined

## Memory tip

Remember the big three protocol numbers with the phrase 'I Can't Understand This' where I is 1 for ICMP, C is 6 for TCP because C is the 3rd letter but 6 is double 3, and U is 17 for UDP because U is the 21st letter, but think of UDP as the 'unreliable' protocol that uses the number 17 to remind you it is not as reliable as TCP.

## FAQ

**What is a protocol number in simple terms?**

A protocol number is a small number in an IP packet that tells the computer which protocol to use to process the data. It is like a label that says whether the data is TCP, UDP, or ICMP.

**How is a protocol number different from a port number?**

A protocol number identifies the transport layer protocol (like TCP or UDP), while a port number identifies the specific application or service (like HTTP or DNS). They work at different layers of the network stack.

**What are the most common protocol numbers I need to know for exams?**

The most common protocol numbers are 1 for ICMP, 6 for TCP, 17 for UDP, 47 for GRE, 88 for EIGRP, and 89 for OSPF. Memorize these for your certification exams.

**Where is the protocol number located in an IP packet?**

In IPv4, it is in the Protocol field of the IP header. In IPv6, it is in the Next Header field. Both are 8-bit fields that identify the next-layer protocol.

**Can I change the protocol number assigned to a protocol?**

No. Protocol numbers are assigned by the Internet Assigned Numbers Authority (IANA) and are standardized globally. Changing them would break compatibility with other devices and networks.

**How do firewalls use protocol numbers?**

Firewalls use protocol numbers to filter traffic. For example, a firewall can be configured to allow only TCP traffic (protocol 6) or block all ICMP traffic (protocol 1). This helps enforce security policies.

**Why is ICMP protocol number 1 important?**

ICMP is used for network diagnostics like ping and traceroute. Protocol number 1 identifies ICMP packets, allowing routers and hosts to process them differently from regular data traffic.

**What happens if a device receives a packet with an unknown protocol number?**

The device will typically drop the packet because it does not have a protocol handler for that number. This can be a security feature, as unknown protocol numbers may indicate malicious or misconfigured traffic.

## Summary

A protocol number is a small but essential field in an IP packet that identifies the transport layer protocol being used. It is an 8-bit value in the IP header, ranging from 0 to 255, with common values like 6 for TCP, 17 for UDP, and 1 for ICMP. This number allows the receiving device to quickly hand off the packet to the correct protocol handler, a process called demultiplexing. Without protocol numbers, network communication would be chaotic and inefficient. Understanding protocol numbers is vital for network configuration, firewall rules, and troubleshooting. Certification exams from CompTIA and Cisco frequently test your knowledge of protocol numbers, often in matching questions, scenario-based questions, and configuration tasks. You must distinguish protocol numbers from port numbers and know the key values for common protocols. When you study, focus on the big three, plus the routing protocol numbers for OSPF and EIGRP. Remember that protocol numbers are standardized by IANA, so they are consistent across all devices. By mastering this simple concept, you will strengthen your foundation in networking and be better prepared for both exams and real-world IT work.

---

Practice questions and the full interactive page: https://courseiva.com/glossary/protocol-number