The IANA Protocol Name representing the official registered name for well-known network protocols. For more information, see RFC 5237 and RFC 7045.
Data Type
String
Aliases
|
Use |
Alias |
|---|---|
|
Client Console Full Name |
Known Application |
|
Client Console Short Name |
Not applicable |
|
Web Console Tab/Name |
Application |
|
OpenSearch Field Name |
application/protocolName/serviceName |
|
Rule Builder Column Name |
<protname> |
|
Regex Pattern |
<protname> |
|
NetMon Name |
Not applicable |
Field Relationships
-
SIP
-
SIPv4
-
SIPv6
-
SIPv6E
-
Origin Hostname
-
Origin Hostname or IP
-
Origin NAT IP
-
DIP
-
DIPv4
-
DIPv6
-
DIPv6E
-
Impacted Hostname
-
Impacted Hostname or IP
-
Impacted NAT IP
-
Origin Port
-
Origin NAT Port
-
Impacted Port
-
Impacted NAT Port
-
Origin MAC Address
-
Impacted MAC Address
-
Origin Interface
-
Impacted Interface
-
Origin Domain
-
Impacted Domain
-
Origin Login
-
Impacted Account
-
IANA Protocol Number
Common Applications
-
Firewalls
-
IDS/IPS
-
NetMon
Use Case
Classifying network traffic.
MPE/Data Masking Manipulations
Compares to list of IANA Protocol Names and is shown in Known Application in the Client Console or Application in the Web Console.
Usage Standards
-
Only parse IANA Protocol Names in this field.
-
If both Protocol Number and Protocol Name are present in a log, parse Protocol Number.
-
For Protocol Names and Numbers, see https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml
Examples
-
FortiGate
12 12 2016 12:18:55 1.1.1.1 <LOC7:ALRT> date=2016-12-12 time=12:18:55 devname=ABC-DEF-FORTIGATE-02 devid=FG80050000000 logid=0419016385 type=utm subtype=ips eventtype=signature level=alert vd=root severity=low srcip=1.1.1.1 srccountry="Reserved" dstip=1.1.1.1 srcintf="WIFI_NETWORK" dstintf="VLAN" policyid=380 sessionid=24634444 action=dropped proto=1 service="PING" attack="Traceroute" icmpid=0x6425 icmptype=0x08 icmpcode=0x00 attackid=12466 profile="IPS_WEB_OUT" ref="http://Host1/ids/VID12345" incidentserialno=123456789 msg="icmp: Traceroute," crscore=5 crlevel=low
Service corresponds with proto=1 which is ICMP (Ping). Service can sometimes indicate an IANA Protocol Name instead of a process. For more information, see http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml.
-
Juniper Firewall
11 06 2009 12:09:51 1.1.1.1 <SAU1:CRIT> dc-dp-1: NetScreen device_id=dc-dp-1 [Root]system-critical-00033: Src IP session limit! From 1.1.1.1:11698 to 1.1.1.1:49156, proto UDP (zone DAVE-PK1 int ethernet0/0.3). Occurred 16 times. (2010-11-06 12:09:50)
Proto shows the Protocol Name UDP instead of a number. Corresponds to protocol number 17. For more information, see http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml.