{"record":{"id":"19c0a0a790773d04","repo":"cilium/cilium","slug":"unknown-protocol-q-19c0a0","errorCode":null,"errorMessage":"unknown protocol: %q","messagePattern":"unknown protocol: %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/hubble/filters/protocol.go","lineNumber":25,"sourceCode":"\t\"context\"\n\t\"fmt\"\n\t\"strings\"\n\n\tflowpb \"github.com/cilium/cilium/api/v1/flow\"\n\tv1 \"github.com/cilium/cilium/pkg/hubble/api/v1\"\n)\n\nfunc filterByProtocol(protocols []string) (FilterFunc, error) {\n\tvar l4Protocols, l7Protocols []string\n\tfor _, p := range protocols {\n\t\tproto := strings.ToLower(p)\n\t\tswitch proto {\n\t\tcase \"icmp\", \"icmpv4\", \"icmpv6\", \"tcp\", \"udp\", \"sctp\", \"vrrp\", \"igmp\":\n\t\t\tl4Protocols = append(l4Protocols, proto)\n\t\tcase \"dns\", \"http\":\n\t\t\tl7Protocols = append(l7Protocols, proto)\n\t\tdefault:\n\t\t\treturn nil, fmt.Errorf(\"unknown protocol: %q\", p)\n\t\t}\n\t}\n\n\treturn func(ev *v1.Event) bool {\n\t\tl4 := ev.GetFlow().GetL4()\n\t\tfor _, proto := range l4Protocols {\n\t\t\tswitch proto {\n\t\t\tcase \"icmp\":\n\t\t\t\tif l4.GetICMPv4() != nil || l4.GetICMPv6() != nil {\n\t\t\t\t\treturn true\n\t\t\t\t}\n\t\t\tcase \"icmpv4\":\n\t\t\t\tif l4.GetICMPv4() != nil {\n\t\t\t\t\treturn true\n\t\t\t\t}\n\t\t\tcase \"icmpv6\":\n\t\t\t\tif l4.GetICMPv6() != nil {\n\t\t\t\t\treturn true","sourceCodeStart":7,"sourceCodeEnd":43,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/hubble/filters/protocol.go#L7-L43","documentation":"filterByProtocol accepts only a fixed allow-list of protocol names: L4 ('icmp', 'icmpv4', 'icmpv6', 'tcp', 'udp', 'sctp', 'vrrp', 'igmp') and L7 ('dns', 'http'). Anything else returns 'unknown protocol: %q', so an unrecognized name aborts filter construction.","triggerScenarios":"Calling OnBuildFilter with FlowFilter Protocol entries such as 'TLS', 'ICMP ' (with whitespace), 'TCP' (uppercase), 'quic', or numeric protocol numbers ('6') — none of which are in the switch.","commonSituations":"Case-sensitivity mistakes (TCP vs tcp), assuming all IANA protocol names or numbers are supported, trying newer protocols (quic, http/2) not yet whitelisted by this Hubble version.","solutions":["Use one of the supported names, lowercase: icmp, icmpv4, icmpv6, tcp, udp, sctp, vrrp, igmp, dns, http","Normalize case and trim whitespace on user input before passing it as a filter","Check your Hubble version — the allow-list has grown over time; upgrade if you need newer protocols","Convert numeric protocol numbers to their names beforehand"],"exampleFix":"// before\nff := &flowpb.FlowFilter{Protocol: []string{\"TLS\"}}\n// after\nff := &flowpb.FlowFilter{Protocol: []string{\"tcp\"}}","handlingStrategy":"validation","validationCode":"var validProtocols = map[string]bool{\n\t\"icmp\": true, \"icmpv4\": true, \"icmpv6\": true, \"tcp\": true, \"udp\": true,\n\t\"sctp\": true, \"vrrp\": true, \"igmp\": true, \"dns\": true, \"http\": true,\n}\nfor _, p := range ff.GetProtocol() {\n\tif !validProtocols[strings.ToLower(strings.TrimSpace(p))] {\n\t\treturn fmt.Errorf(\"unsupported protocol %q\", p)\n\t}\n}","typeGuard":null,"tryCatchPattern":"fs, err := protoFilter.OnBuildFilter(ctx, ff)\nif err != nil && strings.Contains(err.Error(), \"unknown protocol\") {\n\treturn fmt.Errorf(\"see hubble docs for supported protocol names: %w\", err)\n}","preventionTips":["Lowercase and trim protocol names from user input","Pin against the allow-list for your Hubble version","Map IANA protocol numbers to names before filtering"],"tags":["hubble","filters","protocol","validation"],"backgroundTag":"unknown-protocol-value","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}