Huntbook by Predefender

part-5

IP Protocol Numbers

Author: Roger C.B. Johnsen

The IPv4 protocol field and IPv6 Next Header field identify what follows the IP header. They are not TCP or UDP ports: protocol 6 means TCP.

Values worth recognising

DecimalKeywordHunting relevance
0HOPOPTIPv6 extension header; validate parser visibility and expected use.
1ICMPBaseline type, direction, volume, and payload size.
2IGMPUsually local multicast control; routed traffic deserves validation.
4IPv4Encapsulation can be legitimate tunneling or an inspection gap.
6TCPInterpret with ports, flags, direction, process, and result.
17UDPDistinguish request/response from scanning and one-way beaconing.
41IPv6Hunt for unmanaged transition tunnels and unexpected IPv6 use.
43/44/60IPv6 extension headersInspect unusual chains, fragmentation, and sensor coverage.
47GRECommon on infrastructure; unusual from ordinary endpoints.
50/51ESP/AHCorrelate with approved VPN peers; ESP payload is encrypted.
58ICMPv6Essential to IPv6; do not treat all ICMPv6 as hostile.
59No Next HeaderValidate malformed or evasive IPv6 traffic.
88/89EIGRP/OSPFUnexpected from user endpoints or non-routing segments.
103/112PIM/VRRPValidate senders against network-device inventory.
115L2TPv3Distinct from UDP/1701; verify approved tunneling.
132SCTPExpected in some telecom workloads, rare elsewhere.
253-254ExperimentalEstablish local ownership before escalation.
255ReservedValidate parser output and packet integrity.

Fast triage

  1. Confirm this is an IP protocol/Next Header value, not a port.
  2. Identify endpoint roles and compare them with the segment baseline.
  3. Check whether encapsulation or extension headers reduce visibility.
  4. Pivot to duration, bytes, direction, packet capture, process telemetry, and DNS.

Use the live IANA Protocol Numbers registry for exact assignments.

Revision

Revised DateComment
2025-03-16Article added
2026-07-22Reworked as a hunting reference and aligned with IANA