Ask Your Question

Why does the PW-MPLS decoder fails in case the encapsulated Ethernat frame has a destination addrss starting with EC:46:70?

asked 2021-12-15 12:07:02 +0000

updated 2021-12-15 12:41:16 +0000

grahamb gravatar image

Hello Wireshark friends,

The MPLS dissector gets confused in case of MPLS - PW encapsulation, without CW, containing an Ethernet frame, if the destination MAC address of the encapsulated Ethernet Frame corresponds to a Meinberg device, i.e. starts with EC:46:70.

I have to use the Decode As... and select Ethernet PW (no CW).

I am wondering why this happens, what is special in that Meinberg MAC address?

I attached a capture here or screenshot

Please also note that the source MAC address starts with 0x00. I was wondering if this confuses Wireshark as the first 4 bits of that MAC address could be interpreted as CW. However, this might not be the case as Wireshark successfully decodes the last message in my capture where the Destination MAC address is the one starting with 0x00.

Does anyone have any hints, or could point me to the source code of the dissector so I can try to have a look?

Thank you, Andrei

edit retag flag offensive close merge delete


I guss if this is consistent it might be a bug. In whic case I would advise to report a bug. Preferably with a capture file that contains just enough data to replicate the issue by others.

hugo.vanderkooij gravatar imagehugo.vanderkooij ( 2021-12-15 13:20:19 +0000 )edit

This is consistent and can be easily seen by opening the capture. I cheeked on both Windows and CentOS. I am more interested in an explanation than a fix. By the way, is the screenshot visible? The link is:

Andrei Spinu gravatar imageAndrei Spinu ( 2021-12-15 13:26:57 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2021-12-15 17:16:58 +0000

Chuckc gravatar image

Open issue: 13306: Ethernet-PW-without-CW-over-MPLS packets with first nibbles other than 0 not recognized

Looks like it hasn't been touched in a while. Can you add a comment and link back to this question?

edit flag offensive delete link more


Thank you for pointing me to the right place! I added a comment to that issue.

Andrei Spinu gravatar imageAndrei Spinu ( 2021-12-15 17:26:51 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools



Asked: 2021-12-15 11:59:59 +0000

Seen: 130 times

Last updated: Dec 15 '21