Re: decode MPLS-contained packets?

[Gert Doering via tcpdump-workers <tcpdump-workers () lists tcpdump org>]

> --- Begin Message ---
>
>
> From: Gert Doering <gert () greenie muc de>
>
> Date: Tue, 5 May 2020 20:37:51 +0200
>
> Hi,
>
> On Tue, May 05, 2020 at 07:28:28PM +0200, Francois-Xavier Le Bail wrote:
> > On 05/05/2020 12:15, Gert Doering via tcpdump-workers wrote:
> > > In my case, there is an MPLS control word before the ethernet header
> > > ("0000 0000"), and if I skip that and just clear "ethernet in here", I
> > > get nicely printed packets...
> >
> > It seems it is like:
> > https://tools.ietf.org/html/rfc4448#section-4.6
> >
> > Can you confirm?
>
> This very much looks like it, indeed.
>
> So, given that the first 16 bits are "4 bit always 0, and 12 bits
> reserved-must-be-set-to-0", using these as heuristics for "if two 0-bytes
> are following the MPLS headers, it's a control word, so we skip 4 bytes
> and the rest is a regular Ethernet packet" should work.
>
> Thanks for digging up that reference :)
>
> gert
> -- 
> "If was one thing all people took for granted, was conviction that if you 
>  feed honest figures into a computer, honest figures come out. Never doubted 
>  it myself till I met a computer with a sense of humor."
>                              Robert A. Heinlein, The Moon is a Harsh Mistress
>
> Gert Doering - Munich, Germany                             gert () greenie muc de
>
> --- End Message ---
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers