Which protocol does Snort focus to decode, process, and alert on suspicious network traffic?

On which protocol does Snort focus to decode, process, and alert on suspicious network traffic?
A. Apple talk
B. TCP/IP
C. IPX/SPX
D. ICMP