PHP getprotobynumber() Function: Everything You Need to Know

Network protocols travel across the wire as numbers, not names. In an IP packet, TCP is 6, UDP is 17, and ICMP is 1 — there is no human-readable label attached. When PHP code reads a raw protocol number (for example from a parsed packet, a firewall log, or another C-level network call) you often want to turn that number back into a name you can read. The getprotobynumber() function does exactly that: it looks up a protocol number and returns its registered name.

This chapter explains what the function returns, how it reads the system protocol database, the gotchas around portability, and how it pairs with its inverse, getprotobyname().

What is the getprotobynumber() Function?

getprotobynumber() is a built-in PHP function that maps a numeric protocol identifier to its registered protocol name. It reads from the system's protocol database — typically /etc/protocols on Unix-like systems, or %SystemRoot%\system32\drivers\etc\protocol on Windows — and returns the matching name as a string.

A common misconception is that it returns an array. It does not: the return value is a plain string such as "tcp", or false if no protocol with that number is registered on the system. Because the lookup depends on the local protocol file, the same number can in theory resolve differently across operating systems, though the well-known protocol numbers are standardized by IANA and consistent everywhere.

Syntax

getprotobynumber(int $protocol): string|false

The function takes one parameter:

• $protocol: The protocol number to look up (for example 6 for TCP).

It returns the protocol name as a string on success, or false if the number is not found in the protocol database.

Basic Example

The protocol number 6 is TCP. The example below looks it up and handles the failure case explicitly with a strict (===) comparison, since false is the only error signal:

Output:

Protocol number 6 is 'tcp'

Use the strict === comparison rather than !$protocol_name, because a valid name is always a non-empty string — but checking against false explicitly keeps the intent clear and avoids edge cases.

Common Protocol Numbers

These well-known numbers are standardized by IANA and present on virtually every system:

You can iterate a range to see which numbers your system recognizes:

<?php

foreach ([1, 6, 17, 132, 9999] as $number) {
  $name = getprotobynumber($number);
  echo $number . ' => ' . ($name === false ? '(unknown)' : $name) . PHP_EOL;
}

A number like 9999 is not assigned, so the lookup returns false and prints (unknown).

getprotobynumber() vs getprotobyname()

The two functions are exact inverses of each other:

• getprotobynumber(6) returns the string "tcp".
• getprotobyname("tcp") returns the integer 6.

Use getprotobynumber() when you have a raw number (from a packet, log, or socket call) and need a readable name. Use getprotobyname() when you have a name and need the number — for example to pass as the $protocol argument when opening a raw socket.

When Would I Use This?

• Reading packet captures or firewall logs, which record the numeric protocol field of the IP header.
• Displaying human-friendly output in network diagnostic or monitoring tools.
• Validating that a protocol number is one your system knows about before acting on it.

For higher-level networking you will more often reach for the host- and service-lookup helpers: getservbyport() and getservbyname() map ports to service names, while gethostbyname() resolves hostnames.

Conclusion

getprotobynumber() converts a numeric protocol identifier into its registered name, returning a string (not an array) or false when the number is unknown. It reads the local protocol database and is the inverse of getprotobyname(). Knowing that it returns a plain string — and checking for false with a strict comparison — is the key to using it correctly.

Practice