Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. drivers
  5. etc
  6. protocol
FileRisk: Caution

protocol C:\Windows\System32\drivers\etc\protocol

protocol: text file mapping an IP protocol name to its number (tcp 6, udp 17, icmp 1), inherited from Unix. It has no effect on the Windows TCP/IP stack.

Updated on By AltF4 Formation

What it’s for

protocol maps an IP protocol name to its official number: ip 0, icmp 1, tcp 6, udp 17, ipv6 41. The Winsock getprotobyname and getprotobynumber APIs read it for applications that display or accept protocol names. Unlike hosts, it changes nothing about how the network behaves.

What it contains

  • Lines in the form name number [alias] [# comment], for example tcp 6 TCP # transmission control protocol.
  • The standard list of the most common IP protocols.

Risks and best practices

  • The Windows TCP/IP stack does not rely on this file, so a wrong value only skews what the tools that read it display.
  • Editing it takes administrator rights, and there is no reason to. A change nobody can explain is suspect, so compare the file with a known hash.

Useful commands

Fenêtre de terminal
# Useful entries (without comments)
Get-Content "$env:windir\System32\drivers\etc\protocol" | Where-Object { $_ -notmatch '^\s*#' -and $_.Trim() }


# Hash to detect a later change
Get-FileHash "$env:windir\System32\drivers\etc\protocol" -Algorithm SHA256

Report a mistake