Ask Your Question

Revision history [back]

Why does the PW-MPLS decoder fails in case the encapsulated Ethernat frame has a destination addrss starting with EC:46:70?

Hello Wireshark friends,

The MPLS dissector gets confused in case of MPLS - PW encapsulation, without CW, containing an Ethernet frame, if the  destination MAC address of the encapsulated Ethernet Frame corresponds to a Meinberg device, i.e. starts with EC:46:70.

I have to use the Decode As... and select Ethernet PW (no CW). I am wondering why this happens, what is special in that Meinberg MAC address? I attached a capture here: https://drive.google.com/file/d/1mThf9CnKl-mCdT6lPT2YXkKLiFJeeHZU/view?usp=sharing or screenshot here: image description

Please also note that the source MAC address starts with 0x00. I was wondering if this confuses Wireshark as the first 4 bits of that MAC address could be interpreted as CW. However, this might not be the case as Wireshark successfully decodes the last message in my capture where the Destination MAC address is the one starting with 0x00.

Does anyone have any hints, or could point me to the source code of the dissector so I can try to have a look?

Thank you, Andrei

click to hide/show revision 2
None

updated 2021-12-15 12:40:32 +0000

grahamb gravatar image

Why does the PW-MPLS decoder fails in case the encapsulated Ethernat frame has a destination addrss starting with EC:46:70?

Hello Wireshark friends,

The MPLS dissector gets confused in case of MPLS - PW encapsulation, without CW, containing an Ethernet frame, if the  destination MAC address of the encapsulated Ethernet Frame corresponds to a Meinberg device, i.e. starts with EC:46:70.
EC:46:70.

I have to use the Decode As... and select Ethernet PW (no CW). CW).

I am wondering why this happens, what is special in that Meinberg MAC address? address?

I attached a capture here: https://drive.google.com/file/d/1mThf9CnKl-mCdT6lPT2YXkKLiFJeeHZU/view?usp=sharing here or screenshot here: image descriptionscreenshot

Please also note that the source MAC address starts with 0x00. I was wondering if this confuses Wireshark as the first 4 bits of that MAC address could be interpreted as CW. However, this might not be the case as Wireshark successfully decodes the last message in my capture where the Destination MAC address is the one starting with 0x00.

Does anyone have any hints, or could point me to the source code of the dissector so I can try to have a look?

Thank you, Andrei

click to hide/show revision 3
None

updated 2021-12-15 12:41:16 +0000

grahamb gravatar image

Why does the PW-MPLS decoder fails in case the encapsulated Ethernat frame has a destination addrss starting with EC:46:70?

Hello Wireshark friends,

The MPLS dissector gets confused in case of MPLS - PW encapsulation, without CW, containing an Ethernet frame, if the destination MAC address of the encapsulated Ethernet Frame corresponds to a Meinberg device, i.e. starts with EC:46:70.

I have to use the Decode As... and select Ethernet PW (no CW).

I am wondering why this happens, what is special in that Meinberg MAC address?

I attached a capture here or screenshot

Please also note that the source MAC address starts with 0x00. I was wondering if this confuses Wireshark as the first 4 bits of that MAC address could be interpreted as CW. However, this might not be the case as Wireshark successfully decodes the last message in my capture where the Destination MAC address is the one starting with 0x00.

Does anyone have any hints, or could point me to the source code of the dissector so I can try to have a look?

Thank you, Andrei