# Inquiry About Proto Field Values in Suricata Logs

**URL:** <https://forum.suricata.io/t/inquiry-about-proto-field-values-in-suricata-logs/5012>\
**Category:** Help\
**Created:** [November 12, 2024, 6:07am UTC](https://forum.suricata.io/t/inquiry-about-proto-field-values-in-suricata-logs/5012 "2024-11-12T06:07:22Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![xifeng](https://avatars.discourse-cdn.com/v4/letter/x/2bfe46/32.png) [@xifeng](https://forum.suricata.io/u/xifeng)\
**Post date:** [November 12, 2024, 6:07am UTC](https://forum.suricata.io/t/inquiry-about-proto-field-values-in-suricata-logs/5012/1 "2024-11-12T06:07:22Z")

</div>

Suricata: 7.0.6/7  
I am seeking clarification regarding the “proto” field within the log entries as below. Could you please let me know or provide a link about the various possible values that the “proto” field might contain? And is there a possibility for expanding the ‘proto’ values in the future? Thank you in advance!

The log for example:

 ![image](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/6/6a62c49cd0f95a7cfca8499ffd4bc5cc1d74e8b6.png)

---

<div class="post-metadata">

**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\
**Post date:** [November 12, 2024, 9:03am UTC](https://forum.suricata.io/t/inquiry-about-proto-field-values-in-suricata-logs/5012/2 "2024-11-12T09:03:03Z")

</div>

The protocol names are built-in to Suricata. We used to use the system’s `/etc/protocols` but that was not reliable in some situations

We use the IANA definitions – see the source code file `src/util-proto-name.c` for the full list.