tcpdump mailing list archives
Re: decode MPLS-contained packets?
From: Francois-Xavier Le Bail via tcpdump-workers <tcpdump-workers () lists tcpdump org>
Date: Thu, 7 May 2020 09:37:28 -0400 (EDT)
--- Begin Message --- From: Francois-Xavier Le Bail <devel.fx.lebail () orange fr>
Date: Thu, 7 May 2020 15:39:19 +0200
On 07/05/2020 09:39, Francois-Xavier Le Bail via tcpdump-workers wrote:In this *particular* case, that test is done only if the uppermost nibble of the uppermost octet is 0, so that would only be the case for the source address, which is less likely to be a group address than the destination address. There may be other places where that heuristic dissector is used, however.Ok. What if the first nibble is <> de 4, 6, 1, 0, e.g. 'f' like the first f of ff:ff:ff:ff:ff:ff ?Currently tshark don't decode if first nibble is <> de 4, 6, 1, 0: (ARP request not seen, just "Data") --------------------------------------------------------------------------- MultiProtocol Label Switching Header, Label: 262145, Exp: 0, S: 1, TTL: 253 0100 0000 0000 0000 0001 .... .... .... = MPLS Label: 262145 .... .... .... .... .... 000. .... .... = MPLS Experimental Bits: 0 .... .... .... .... .... ...1 .... .... = MPLS Bottom Of Label Stack: 1 .... .... .... .... .... .... 1111 1101 = MPLS TTL: 253 Data (64 bytes) 0000 ff ff ff ff ff ff 00 50 79 66 68 01 08 06 00 01 .......Pyfh..... 0010 08 00 06 04 00 01 00 50 79 66 68 01 0a 48 01 42 .......Pyfh..H.B 0020 ff ff ff ff ff ff 0a 48 01 43 00 00 00 00 00 00 .......H.C...... 0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Data: ffffffffffff005079666801080600010800060400010050796668010a480142ffffffff<E2> <80><A6> [Length: 64] --------------------------------------------------------------------------- 1 16:26:10.061638 ca:04:2c:7e:00:08 > 00:b5:df:d1:63:02, ethertype MPLS unicast (0x8847), length 82: MPLS (label 262145, exp 0, [S], ttl 253) 00:50:79:66:68:01 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 64: Ethernet (len 6), IPv4 (len 4), Request who-has 10.72.1.67 (ff:ff:ff:ff:ff:ff) tell 10.72.1.66, length 50 --------------------------------------------------------------------------- -- Francois-Xavier
--- End Message ---
_______________________________________________ tcpdump-workers mailing list tcpdump-workers () lists tcpdump org https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
Current thread:
- Re: decode MPLS-contained packets?, (continued)
- Message not available
- Message not available
- Message not available
- Re: decode MPLS-contained packets? Gert Doering via tcpdump-workers (May 05)
- Message not available
- Message not available
- Message not available
- Message not available
- Re: decode MPLS-contained packets? Francois-Xavier Le Bail via tcpdump-workers (May 05)
- Re: decode MPLS-contained packets? Guy Harris via tcpdump-workers (May 07)
- Message not available
- Re: decode MPLS-contained packets? Gert Doering via tcpdump-workers (May 07)
- Message not available
- Message not available
- Message not available
- Message not available
- Re: decode MPLS-contained packets? Francois-Xavier Le Bail via tcpdump-workers (May 06)
- Re: decode MPLS-contained packets? Francois-Xavier Le Bail via tcpdump-workers (May 07)
- Re: decode MPLS-contained packets? Guy Harris via tcpdump-workers (May 07)
- Message not available
- Re: decode MPLS-contained packets? Francois-Xavier Le Bail via tcpdump-workers (May 07)
- Re: decode MPLS-contained packets? Gert Doering via tcpdump-workers (May 07)
- Re: decode MPLS-contained packets? Francois-Xavier Le Bail via tcpdump-workers (May 07)
- Message not available
- Re: decode MPLS-contained packets? Francois-Xavier Le Bail via tcpdump-workers (May 08)
- Message not available
- Message not available
- Message not available
- Message not available
- Re: decode MPLS-contained packets? Gert Doering via tcpdump-workers (May 07)
- Re: decode MPLS-contained packets? Gert Doering via tcpdump-workers (May 07)
- Message not available
- Message not available
- Message not available
- Message not available
- Message not available
- Re: decode MPLS-contained packets? Francois-Xavier Le Bail via tcpdump-workers (May 07)