A fast, offline reference for the three number spaces you forget mid-capture: IP protocol numbers, Ethernet EtherTypes, and ICMP type/code values. Type to filter any table.
| Dec | Hex | Keyword | Protocol |
|---|
| Hex | Keyword | Protocol |
|---|
| Type | Name | Notes |
|---|
These three values live in different headers but get confused constantly. The EtherType sits in the Ethernet frame and says what the payload is — 0x0800 for IPv4, 0x86DD for IPv6, 0x0806 for ARP. Inside an IP packet, the protocol number says what the IP payload is — 6 for TCP, 17 for UDP, 1 for ICMP. And within ICMP, the type field says what kind of message it is — 8 echo request, 0 echo reply, 3 destination unreachable.
Firewall logs, ACLs, flow records, and packet captures all surface these as bare numbers. A proto 47 in a flow record is GRE; an EtherType 0x8100 means an 802.1Q VLAN tag follows. Recognizing them on sight saves a tab-switch.
TCP is IP protocol 6, UDP is 17. ICMP is 1 and ICMPv6 is 58.
0x86DD. IPv4 is 0x0800 and ARP is 0x0806.
No — it covers the values engineers actually meet in practice. The full registries are maintained by IANA.