Re: MPLS over UDP decoding

[Guy Harris <guy () alum mit edu>]

On Dec 27, 2018, at 3:01 PM, Yang Yu <yang.yu.list () gmail com> wrote:

> In a packet capture of sFlow export packets, I noticed some sFlow
> samples were decoded as MPLS over UDP. The sFlow sampled packet was
> actually just a UDP VoIP packet with no dissector support.
>
> What logic does Wireshark use to opportunistically consider UDP
> payload to be MPLS?

From looking at the code, the logic appears to be "is the traffic to or from UDP port 6635?"

So *is* the traffic to or from UDP port 6635?
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    https://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe