{"record":{"id":"e9f634d3c6187c4b","repo":"elastic/elasticsearch","slug":"invalid-transport-protocol-number","errorCode":null,"errorMessage":"invalid transport protocol number [{}]","messagePattern":"invalid transport protocol number \\[(.+?)\\]","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CommunityIdProcessor.java","lineNumber":472,"sourceCode":"\n        private Transport(Type type) {\n            this.transportNumber = type.getTransportNumber();\n            this.type = type;\n        }\n\n        public Type getType() {\n            return this.type;\n        }\n\n        public int getTransportNumber() {\n            return transportNumber;\n        }\n\n        // visible for testing\n        static Transport fromNumber(int transportNumber) {\n            if (transportNumber < 0 || transportNumber >= 255) {\n                // transport numbers range https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml\n                throw new IllegalArgumentException(\"invalid transport protocol number [\" + transportNumber + \"]\");\n            }\n\n            Type type = switch (transportNumber) {\n                case 1 -> Type.Icmp;\n                case 2 -> Type.Igmp;\n                case 6 -> Type.Tcp;\n                case 17 -> Type.Udp;\n                case 47 -> Type.Gre;\n                case 58 -> Type.IcmpIpV6;\n                case 88 -> Type.Eigrp;\n                case 89 -> Type.Ospf;\n                case 103 -> Type.Pim;\n                case 132 -> Type.Sctp;\n                default -> Type.Unknown;\n            };\n\n            return new Transport(transportNumber, type);\n        }","sourceCodeStart":454,"sourceCodeEnd":490,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CommunityIdProcessor.java#L454-L490","documentation":"Transport.fromNumber requires the IANA protocol number to be in [0, 254] (the check is '< 0 || >= 255'). Values outside that range are rejected even though the IANA registry tops out at 255. Thrown from buildFlow when iana_number (or transport-as-integer) resolves to such a value.","triggerScenarios":"network.iana_number or a numeric network.transport field set to 255, 256, -1, or any value > 254. Common with mis-typed fields where a port number was accidentally written into the iana_number field.","commonSituations":"Upstream confusion between port and protocol number; an aggregation that wrote a sentinel like 999; test fixtures with placeholder values; producer emits an unsigned byte but writes it as a signed value that decoded negative.","solutions":["Verify network.iana_number is the IANA protocol number (e.g. 6=TCP, 17=UDP, 1=ICMP), not a port.","If the value is a signed-byte mis-decode, fix the upstream parser to treat it as unsigned.","Use network.transport as a protocol name ('tcp','udp') instead of a numeric iana_number if your data is unreliable.","Quarantine failures via on_failure."],"exampleFix":"// before — value out of IANA range\n//   { \"network\": { \"iana_number\": 256 } }\n//\n// after — valid IANA protocol number\n//   { \"network\": { \"iana_number\": 6 } }","handlingStrategy":"validation","validationCode":"boolean isValidIanaNumber(Object o) {\n    if (o instanceof Number n) { int v = n.intValue(); return v >= 0 && v < 255; }\n    if (o instanceof String s && s.matches(\"-?\\\\d+\")) {\n        int v = Integer.parseInt(s); return v >= 0 && v < 255;\n    }\n    return false;\n}","typeGuard":null,"tryCatchPattern":"{\n  \"community_id\": {\n    \"on_failure\": [\n      { \"set\": { \"field\": \"ingest.error\", \"value\": \"community-id-bad-iana-number\" } },\n      { \"redirect\": { \"pipeline\": \"quarantine\" } }\n    ]\n  }\n}","preventionTips":["Confirm network.iana_number is the IANA protocol number (6=TCP, 17=UDP, 1=ICMP), not a port.","Reject values 255 and above — they are outside the parser's accepted range.","If your sensor emits signed-byte protocol values, normalize to unsigned upstream."],"tags":["ingest","community-id","transport","validation"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T08:17:17.861Z"}