Ask Your Question
0

Is there a plug-in showing MPLS statistics?

asked 2021-08-19 22:00:47 +0000

Slaw_k gravatar image

updated 2021-08-23 14:43:51 +0000

cmaynard gravatar image

Hello, Is there a plug-in for Wireshark which can show MPLS statistics? For instance list of all the labels found with a number of appearances, number of packets with 1,2 or 3 labels in the stack, etc.

Thanks a lot, Slawek

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2021-08-22 08:51:25 +0000

Eddi gravatar image

I am not aware of a plugin. Depending on your requirements, you might get away with the command line tool tshark. For starters, try this:

tshark -r "mytrace.pcapng" -T fields -e mpls.label -Y "mpls"

A few comments, in case you (or another reader) are not familiar with tshark:

  • -r mytrace.pcapng is obviously the capture file name
  • -T fields tells tshark to extract the content of certain fields
  • -e mpls.label is the desired field. This will print the whole label stack, like 21,22
  • -Y mpls is the display filter used to process the file. This makes sure, that you don't have empty lines (caused by packets without MPLS label stack) in the output.

If you want to focus on an individual label you can work with the tshark option -z

 -z io,stat,0,"COUNT(frame)frame"

Specify a filter, say -Y "mpls.label==21" to get the number of packets with an MPLS label 21.

The documentation tells me, that the command line option -q should suppress the packet decode for all lines. For a reason unknown to me, my tshark 3.4.7 insists on printing all lines, when I combine -z with -q.

Good luck

Eddi

edit flag offensive delete link more

Comments

p$ tshark  -q -r ./mpls-basic.cap -z io,stat,0,"COUNT(frame)mpls.label==29"

=====================================
| IO Statistics                     |
|                                   |
| Duration: 24.5 secs               |
| Interval: 24.5 secs               |
|                                   |
| Col 1: COUNT(frame)mpls.label==29 |
|-----------------------------------|
|              |1      |            |
| Interval     | COUNT |            |
|----------------------|            |
|  0.0 <> 24.5 |    17 |            |
=====================================


(capture file available here: wikis/SampleCaptures

Chuckc gravatar imageChuckc ( 2021-08-22 15:11:54 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2021-08-19 22:00:47 +0000

Seen: 544 times

Last updated: Aug 23 '21