A protocol number gets its meaning from a pinned lookup table. The byte is small, but the table gives it an operational name.

highlighted = computed this step

Why a number names a protocol

A protocol field is small, so the byte carries a number instead of a word. The reader uses the pinned table to recover the protocol name.

protocol byte=6\text{protocol byte}=6

A number names a protocol

The protocol byte is 6. The pinned table maps that value to TCP.

6TCP6\mapsto TCP
Enumerated protocol fieldA byte becomes a name through a pinned enum table.Protocol8 bits / 1 byte0x06byte 000000110protocol6->TCP

Table note

The shown name is not typed separately in the diagram. It is recomputed from the byte and the table.

protocol=6\text{protocol}=6
Enumerated protocol fieldA byte becomes a name through a pinned enum table.Protocol8 bits / 1 byte0x06byte 000000110protocol6->TCP

Decode it again

The same lookup that mapped 6 to TCP now maps 17 to UDP — the table is the rule, not the single value.

17UDP17\mapsto UDP
Another protocol fieldThe same enum table maps another byte.0x118 bits / 1 byte0x11byte 000010001protocol17->UDP

Summary

A small integer stands in for a protocol name, and the table is part of the decode rule. Byte layout only; timing/throughput is not modeled here. Timing/throughput is not modeled here — only the exact byte layout.

protocol byte=6\text{protocol byte}=6
Enumerated protocol fieldA byte becomes a name through a pinned enum table.Protocol8 bits / 1 byte0x06byte 000000110protocol6->TCP