fix: accept protocol names in the NetFlow protocol filter

Charts, records and the Sankey show protocols by name, but the Protocol
filter only matched the raw number, so typing "TCP" returned no flows.
Known names now map to their protocol number before filtering.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: Valery Petrov

packages/app/src/__tests__/netflow.test.ts

@@ -164,6 +164,17 @@ describe('NetFlow queries', () => {
     expect(where).toContain("toString(Proto) = '6'");
   });
 
+  it.each([
+    ['tcp', '6'],
+    [' ICMPv6 ', '58'],
+    ['99', '99'],
+    ['SCTP', 'SCTP'],
+  ])('filters protocol %p as %p', (protocol, expected) => {
+    expect(buildNetflowWhere(source, { protocol })).toBe(
+      `(toString(Proto) = '${expected}')`,
+    );
+  });
+
   it('keeps the source, connection, time range and filters on every query', () => {
     const configs = buildNetflowQueryConfigs({
       source,

packages/app/src/netflow.ts

@@ -1,6 +1,7 @@
 import { FIXED_TIME_BUCKET_EXPR_ALIAS } from '@hyperdx/common-utils/dist/core/renderChartConfig';
 import {
   getSourceImplicitColumnExpression,
+  NETFLOW_PROTOCOL_NAMES,
   netflowProtocolNameExpression,
 } from '@hyperdx/common-utils/dist/core/searchChartConfig';
 import {
@@ -85,14 +86,20 @@ export function getNetflowDimensions(source: TNetflowSource) {
   };
 }
 
+// The protocol filter also accepts the names the charts show, e.g. TCP.
+const protocolNumber = (value?: string) =>
+  Object.entries(NETFLOW_PROTOCOL_NAMES).find(
+    ([, name]) => name.toLowerCase() === value?.trim().toLowerCase(),
+  )?.[0] ?? value;
+
 export function buildNetflowWhere(
   source: TNetflowSource,
   filters: NetflowFilters,
 ) {
   const predicates: string[] = [];
   for (const [value, expression, address] of [
     [filters.exporter, source.exporterExpression, false],
-    [filters.protocol, source.protocolExpression, false],
+    [protocolNumber(filters.protocol), source.protocolExpression, false],
     [filters.srcAddr, source.srcAddrExpression, true],
     [filters.dstAddr, source.dstAddrExpression, true],
   ] as const) {

packages/common-utils/src/core/searchChartConfig.ts

@@ -30,7 +30,7 @@ import {
  */
 export type SearchChartConfig = BuilderChartConfig & Partial<DateRange>;
 
-const NETFLOW_PROTOCOL_NAMES = {
+export const NETFLOW_PROTOCOL_NAMES = {
   1: 'ICMP',
   6: 'TCP',
   17: 'UDP',