Wireshark mailing list archives
Re: MPLS over UDP decoding
From: Guy Harris <guy () alum mit edu>
Date: Fri, 28 Dec 2018 13:06:20 -0800
On Dec 27, 2018, at 3:01 PM, Yang Yu <yang.yu.list () gmail com> wrote:
In a packet capture of sFlow export packets, I noticed some sFlow samples were decoded as MPLS over UDP. The sFlow sampled packet was actually just a UDP VoIP packet with no dissector support. What logic does Wireshark use to opportunistically consider UDP payload to be MPLS?
From looking at the code, the logic appears to be "is the traffic to or from UDP port 6635?" So *is* the traffic to or from UDP port 6635? ___________________________________________________________________________ Sent via: Wireshark-users mailing list <wireshark-users () wireshark org> Archives: https://www.wireshark.org/lists/wireshark-users Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-request () wireshark org?subject=unsubscribe
Current thread:
- MPLS over UDP decoding Yang Yu (Dec 27)
- Re: MPLS over UDP decoding Hugo van der Kooij (Dec 27)
- Re: MPLS over UDP decoding Guy Harris (Dec 28)
- Re: MPLS over UDP decoding Yang Yu (Dec 28)
- Re: MPLS over UDP decoding Guy Harris (Dec 28)
- Re: MPLS over UDP decoding Yang Yu (Dec 28)