Inquiry About Proto Field Values in Suricata Logs

Help
1

Suricata: 7.0.6/7
I am seeking clarification regarding the “proto” field within the log entries as below. Could you please let me know or provide a link about the various possible values that the “proto” field might contain? And is there a possibility for expanding the ‘proto’ values in the future? Thank you in advance!

The log for example:

image
image375×246 4.66 KB

2

The protocol names are built-in to Suricata. We used to use the system’s /etc/protocols but that was not reliable in some situations

We use the IANA definitions – see the source code file src/util-proto-name.c for the full list.