pfSense

The protocol layout isn't defined in the log parser so it doesn't know what to do with it. There is no test for protocol 132 in the block at source:src/etc/inc/syslog.inc#L1101 in parse_firewall_log_line()

There could maybe be a default test at the end to catch unknown protocols, like the IGMP section could be moved down and the protocol check removed from that, so unknown protocols just show source/destination address and no other data.

While there, that whole block should really be a switch statement and not a bunch of if/elseif checks.

PR merged

Seems to be working OK. Logs are showing not only SCTP but also some other entries that were not previously parsed.

Not sure if we want to keep these in the (visible GUI) log or suppress them, but that can be left up to another Redmine request:

The GUI is accurately displaying what is in the filter.log file for those lines, so it's also possible something in filterlog needs adjusted for those entries. Either way it's outside the scope of this issue.