netbirdio/netbird · warning

invalid protocol: use tcp/udp/icmp

Error message

invalid protocol: use tcp/udp/icmp

What it means

Thrown by tracePacket (client/cmd/trace.go:50). The --protocol/-p flag string must be exactly tcp, udp, or icmp (case-sensitive, since the raw flag value is compared); any other value is rejected locally before the daemon RPC. Note flags default to tcp.

Source

Thrown at client/cmd/trace.go:50

	traceCmd.Flags().Uint8("icmp-type", 0, "ICMP type")
	traceCmd.Flags().Uint8("icmp-code", 0, "ICMP code")
	traceCmd.Flags().Bool("syn", false, "TCP SYN flag")
	traceCmd.Flags().Bool("ack", false, "TCP ACK flag")
	traceCmd.Flags().Bool("fin", false, "TCP FIN flag")
	traceCmd.Flags().Bool("rst", false, "TCP RST flag")
	traceCmd.Flags().Bool("psh", false, "TCP PSH flag")
	traceCmd.Flags().Bool("urg", false, "TCP URG flag")
}

func tracePacket(cmd *cobra.Command, args []string) error {
	direction := strings.ToLower(args[0])
	if direction != "in" && direction != "out" {
		return fmt.Errorf("invalid direction: use 'in' or 'out'")
	}

	protocol := cmd.Flag("protocol").Value.String()
	if protocol != "tcp" && protocol != "udp" && protocol != "icmp" {
		return fmt.Errorf("invalid protocol: use tcp/udp/icmp")
	}

	sport, err := cmd.Flags().GetUint16("sport")
	if err != nil {
		return fmt.Errorf("invalid source port: %v", err)
	}
	dport, err := cmd.Flags().GetUint16("dport")
	if err != nil {
		return fmt.Errorf("invalid destination port: %v", err)
	}

	// For TCP/UDP, generate random ephemeral port (49152-65535) if not specified
	if protocol != "icmp" {
		if sport == 0 {
			sport = uint16(rand.Intn(16383) + 49152)
		}
		if dport == 0 {
			dport = uint16(rand.Intn(16383) + 49152)

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Use lowercase tcp, udp, or icmp for -p/--protocol
2. Omit the flag entirely when tcp is intended (it is the default)

var validProto = map[string]bool{"tcp": true, "udp": true, "icmp": true}
if !validProto[proto] {
    log.Fatalf("protocol must be tcp, udp, or icmp (lowercase), got %q", proto)
}

func isTraceProtocol(s string) bool { return s == "tcp" || s == "udp" || s == "icmp" }

When it happens

Trigger: Running 'netbird debug trace ... -p TCP' (uppercase fails - the comparison is case-sensitive against cmd.Flag("protocol").Value.String()), or -p gre, -p sctp, or a typo like -p icpm.

Common situations: Upper-casing the protocol out of habit; scripts looping over a protocol list that includes protocols the tracer does not model.

Related errors

• invalid direction: use 'in' or 'out'
• invalid source port: %v
• invalid destination port: %v
• failed initializing log %v
• trace failed: %v

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/a339cac5f072cb21. Report an issue: GitHub.