This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I have a frame with two mpls headers. How to filer with a field in a specific mpls header?

0

My frames MPLS headers are as follows:

        MultiProtocol Label Switching Header, Label: 13746, Exp: 0, S: 0, TTL: 255
              0000 0011 0101 1011 0010 .... .... .... = MPLS Label: 13746
              .... .... .... .... .... 000. .... .... = MPLS Experimental Bits: 0
              .... .... .... .... .... ...0 .... .... = MPLS Bottom Of Label Stack: 0
              .... .... .... .... .... .... 1111 1111 = MPLS TTL: 255
        MultiProtocol Label Switching Header, Label: 19772, Exp: 0, S: 1, TTL: 2
              0000 0100 1101 0011 1100 .... .... .... = MPLS Label: 19772
              .... .... .... .... .... 000. .... .... = MPLS Experimental Bits: 0
              .... .... .... .... .... ...1 .... .... = MPLS Bottom Of Label Stack: 1
              .... .... .... .... .... .... 0000 0010 = MPLS TTL: 2

I want to filter with respect to mpls header of only first mpls frame. If I use filter like 'mpls.label == 13746' wireshark filters even those frames where second mpls headers label is 13746 even though second mpls header is different. I How to achieve filtering with respect to only first mpls headers label field?

This question is marked "community wiki".

asked 09 Sep '14, 22:42

Chetan%20Ragi's gravatar image

Chetan Ragi
11336
accept rate: 0%

edited 10 Sep '14, 03:57

Jaap's gravatar image

Jaap ♦
11.7k16101


One Answer:

0

Use a distinguishing mark of the outer label, eg. MPLS Bottom Of Label Stack == 0. But this only helps if you always have two labels. A real solution would require an addition to the Wireshark display filter engine to be able to address the level at which the field occurs.

answered 10 Sep '14, 03:57

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%