Is an IP protocol number the same as a port number?

No. The protocol number is an 8-bit field in the IP header that names the next-layer protocol, such as 6 for TCP or 17 for UDP. Port numbers belong to TCP and UDP themselves and identify the application endpoint.

Where does the protocol number live in IPv6?

IPv6 has no Protocol field. The same values appear in the Next Header field of the IPv6 base header (and of each extension header), forming a chain that ends at the upper-layer protocol.

What protocol numbers do IPsec tunnels use?

IPsec uses protocol 50 for the Encapsulating Security Payload (ESP) and protocol 51 for the Authentication Header (AH). Firewalls must permit these numbers directly, not just UDP/TCP ports, unless NAT-Traversal wraps ESP in UDP 4500.

Why is OSPF assigned its own protocol number?

OSPF runs directly over IP as protocol 89 rather than over TCP or UDP, so it carries no port. Routers identify and filter OSPF traffic by this protocol number.

What is protocol number 41 used for?

Protocol 41 is IPv6 encapsulation — it carries an IPv6 packet inside an IPv4 packet, the basis of 6in4 tunnels used to reach IPv6 over an IPv4-only path.

What is the IP Protocol Numbers?

IANA IP protocol number reference for the IPv4 Protocol field and IPv6 Next Header value, covering TCP, UDP, ICMP, OSPF, GRE, ESP, AH, SCTP and more with the defining RFC. Bundled offline. It runs free in your browser on Gera Tools, with nothing uploaded.

IP Protocol Numbers — Gera Tools

Name: IP Protocol Numbers
Creator: Gera Tools
License: https://creativecommons.org/licenses/by/4.0/

Get one useful tool a week

Like this tool? Enter your email and we'll send you one genuinely useful Gera tool a week — plus a link to come back to this one. No spam, one-click unsubscribe any time.

Every IP packet carries an 8-bit value that names the protocol immediately above IP: 6 for TCP, 17 for UDP, 1 for ICMP, and dozens more. In IPv4 this is the Protocol field in the IP header; in IPv6 it is the Next Header value. This reference lets you search the IANA registry by number or by name so you can read packet captures, write firewall rules, and understand tunnelling protocols.

The Protocol field vs port numbers

These are two distinct things that people often conflate:

IP Protocol number — an 8-bit field in the IP header identifying the layer-4 protocol (TCP, UDP, ICMP, etc.). It tells the OS how to hand off the packet.
Port number — a 16-bit field inside TCP or UDP packets, identifying the application within that transport protocol.

Firewalls can filter on either or both. A rule that allows TCP port 443 (HTTPS) is different from a rule that allows IP protocol 6 (TCP). Some protocols — OSPF, GRE, ESP, AH — have no ports at all and must be allowed by protocol number.

The IPv6 Next Header chain

IPv6 has no Protocol field; instead it uses a Next Header chain. The base IPv6 header’s Next Header points to the first extension header (or directly to the upper-layer protocol if there are none). Each extension header also has a Next Header field pointing to the next item. The chain ends at the upper-layer protocol number — which uses the same IANA values as the IPv4 Protocol field.

This means protocol 6 means TCP in both IPv4 and IPv6 packets, and 58 (ICMPv6) is IPv6-only while 1 (ICMP) is IPv4-only.

Common protocol numbers quick reference

1    ICMP          (ping, traceroute — IPv4 only)
2    IGMP          (multicast group management)
6    TCP           (web, email, SSH, most applications)
17   UDP           (DNS, DHCP, streaming, QUIC)
41   IPv6-in-IPv4  (6in4 tunnels)
47   GRE           (GRE tunnels, PPTP data)
50   ESP           (IPsec Encapsulating Security Payload)
51   AH            (IPsec Authentication Header)
58   ICMPv6        (ping, neighbor discovery — IPv6 only)
88   EIGRP         (Cisco routing protocol)
89   OSPF          (link-state routing, no ports)
112  VRRP          (virtual router redundancy)
132  SCTP          (telecom, WebRTC transport)

Practical firewall and capture examples

IPsec site-to-site VPN: UDP 500 (IKE key exchange) and protocol 50 (ESP) must both be permitted through the firewall. Permitting UDP 500 alone is a common mistake — IKE negotiates the tunnel but ESP carries the encrypted data, so if protocol 50 is blocked, IKE succeeds and the tunnel appears to come up but no traffic passes.

GRE tunnel: Protocol 47 must be permitted end-to-end. It has no port number, so adding TCP or UDP rules does nothing.

OSPF in a firewall policy: Protocol 89 must be explicitly allowed between OSPF neighbors. OSPF runs directly over IP, so an “allow all TCP/UDP” rule does not help.

Wireshark / tcpdump filter: Use proto 50 to capture ESP, icmp for ICMP, or proto 89 for OSPF traffic.

When a tunnel looks like it is configured correctly but carries no data, checking whether the relevant protocol number is permitted in firewall rules is one of the first diagnostic steps.