elastic/elasticsearch · error · IllegalArgumentException

invalid transport protocol number [{}]

Error message

invalid transport protocol number [{}]

What it means

Transport.fromNumber requires the IANA protocol number to be in [0, 254] (the check is '< 0 || >= 255'). Values outside that range are rejected even though the IANA registry tops out at 255. Thrown from buildFlow when iana_number (or transport-as-integer) resolves to such a value.

Source

Thrown at modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CommunityIdProcessor.java:472

        private Transport(Type type) {
            this.transportNumber = type.getTransportNumber();
            this.type = type;
        }

        public Type getType() {
            return this.type;
        }

        public int getTransportNumber() {
            return transportNumber;
        }

        // visible for testing
        static Transport fromNumber(int transportNumber) {
            if (transportNumber < 0 || transportNumber >= 255) {
                // transport numbers range https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml
                throw new IllegalArgumentException("invalid transport protocol number [" + transportNumber + "]");
            }

            Type type = switch (transportNumber) {
                case 1 -> Type.Icmp;
                case 2 -> Type.Igmp;
                case 6 -> Type.Tcp;
                case 17 -> Type.Udp;
                case 47 -> Type.Gre;
                case 58 -> Type.IcmpIpV6;
                case 88 -> Type.Eigrp;
                case 89 -> Type.Ospf;
                case 103 -> Type.Pim;
                case 132 -> Type.Sctp;
                default -> Type.Unknown;
            };

            return new Transport(transportNumber, type);
        }

View on GitHub (pinned to db6a809a66)

Solutions

1. Verify network.iana_number is the IANA protocol number (e.g. 6=TCP, 17=UDP, 1=ICMP), not a port.
2. If the value is a signed-byte mis-decode, fix the upstream parser to treat it as unsigned.
3. Use network.transport as a protocol name ('tcp','udp') instead of a numeric iana_number if your data is unreliable.
4. Quarantine failures via on_failure.

Example fix

// before — value out of IANA range
//   { "network": { "iana_number": 256 } }
//
// after — valid IANA protocol number
//   { "network": { "iana_number": 6 } }

boolean isValidIanaNumber(Object o) {
    if (o instanceof Number n) { int v = n.intValue(); return v >= 0 && v < 255; }
    if (o instanceof String s && s.matches("-?\\d+")) {
        int v = Integer.parseInt(s); return v >= 0 && v < 255;
    }
    return false;
}

{
  "community_id": {
    "on_failure": [
      { "set": { "field": "ingest.error", "value": "community-id-bad-iana-number" } },
      { "redirect": { "pipeline": "quarantine" } }
    ]
  }
}

When it happens

Trigger: network.iana_number or a numeric network.transport field set to 255, 256, -1, or any value > 254. Common with mis-typed fields where a port number was accidentally written into the iana_number field.

Common situations: Upstream confusion between port and protocol number; an aggregation that wrote a sentinel like 999; test fixtures with placeholder values; producer emits an unsigned byte but writes it as a signed value that decoded negative.

Related errors

• could not convert string [{}] to transport protocol
• invalid source port [{}]
• invalid destination port [{}]
• unable to parse {} [{}]
• could not convert value of type [{}] to transport protocol

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/e9f634d3c6187c4b. Report an issue: GitHub.