Protocols
📚 Reference of the protocols detected by SONAR
Section titled “📚 Reference of the protocols detected by SONAR”This page lists all the values SONAR recognizes automatically when parsing network frames. It covers the protocols detected at the Ethernet, Transport and Application layers, extracted directly from the codebase.
🧩 Application-layer protocols (Application Protocol)
Section titled “🧩 Application-layer protocols (Application Protocol)”| Column | Source | Detected values | Notes |
|---|---|---|---|
Application Protocol | Payload (Layer 7) | DNS, TLS, NTP, Bitcoin, S7Comm, Unknown | Detection based on TryFrom<&[u8]>. If no known protocol is recognized, the value "Unknown" is used. |
ℹ️ Notes:
Section titled “ℹ️ Notes:”- TLS detection stops at the handshake: SONAR does not analyze encrypted content.
- Some protocols such as COTP are under development but not yet enabled in the parser.
🔗 Link-layer protocols (EtherType)
Section titled “🔗 Link-layer protocols (EtherType)”| Column | Source | Detected values | Notes |
|---|---|---|---|
EtherType | ethertype field (Ethernet) | IPv4, IPv6, ARP, VLAN-tagged frame, LLDP, Profinet, MRP, PTP, Q-in-Q, PBridge, Trill, DECnet, Rarp, AppleTalk, Aarp, Ipx, Qnx, MPLS Unicast, MPLS Multicast, PPPoe, CobraNet, cfm, Unknown (0xXXXX) | Value determined from the ethertype field of the Ethernet frame. Unknown if the code is unrecognized. |
ℹ️ Technical notes:
Section titled “ℹ️ Technical notes:”EtherTypeidentifies the encapsulated protocol (IP, ARP, etc.).- SONAR uses this field to dynamically decide which upper-layer parser to invoke.
🚚 Transport protocols (Transport Protocol)
Section titled “🚚 Transport protocols (Transport Protocol)”| Column | Source | Detected values | Notes |
|---|---|---|---|
Transport Protocol | protocol field (IPv4/IPv6) | None, ICMP, ICMPv6, IGMP, TCP, UDP, PIMv2, VRRP, EGP, IGRP, OSPF, EIGRP, GRE, IP-in-IP, ESP, AH, RDP, DCCP, RSVP, SCTP, Unknown | Interpreted according to the official IANA list. Unknown if unmapped. |
ℹ️ Details:
Section titled “ℹ️ Details:”Noneis used when no transport protocol is identified.- Some protocols such as
ESPorAHbelong to network security (IPSec). - The value
Unknownis returned when the protocol number is unknown to SONAR.
✅ Conclusion
Section titled “✅ Conclusion”These tables are the reference for interpreting the flow matrices generated by SONAR. Every column contains only values detected automatically from the captured frames, without any manual interpretation.
🛠️ This page will be updated as the SONAR parsing engine evolves.