tcpdump mailing list archives

Re: decode MPLS-contained packets?


From: Gert Doering via tcpdump-workers <tcpdump-workers () lists tcpdump org>
Date: Tue, 5 May 2020 12:32:52 -0400 (EDT)

--- Begin Message --- From: Gert Doering <gert () greenie muc de>
Date: Tue, 5 May 2020 18:34:40 +0200
Hi,

On Tue, May 05, 2020 at 04:45:04PM +0200, Francois-Xavier Le Bail wrote:
On 05/05/2020 12:15, Gert Doering via tcpdump-workers wrote:
12:11:46.116238 MPLS (label 105, exp 0, ttl 254) (label 24003, exp 0, [S], ttl 254) IP 10.27.99.2 > 10.27.99.34: 
ICMP echo request, id 49866, seq 5160, length 84
12:11:46.117107 MPLS (label 24002, exp 0, [S], ttl 253) IP 10.27.99.34 > 10.27.99.2: ICMP echo reply, id 49866, seq 
5160, length 84


So, for my debugging purposes, I have what I need now.

Could you send a pcap file with the ICMP echo request/reply test ?

Of course.  Attached.  This is EVPN/MPLS between two Cisco ASRs (in
case it makes a difference).  One direction has only a single label
because the final router is on the link I'm sniffing, the other direction
has two labels.

Inside are a few machines pinging around plus one or two ARPs.

(The .cap file is very small, just 4 kbyte, so I dare send it to the
list as well)

And the patch you apply ?

Attached as well.  Not very smart yet, just does "what I need".

gert

-- 
"If was one thing all people took for granted, was conviction that if you 
 feed honest figures into a computer, honest figures come out. Never doubted 
 it myself till I met a computer with a sense of humor."
                             Robert A. Heinlein, The Moon is a Harsh Mistress

Gert Doering - Munich, Germany                             gert () greenie muc de

--- End Message ---
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers

Current thread: