Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 11271] Dissecting engine stops after MPLS shims

[bugzilla-daemon@xxxxxxxxxxxxx]

Comment # 3 on bug 11271 from Jasper Bongertz

So if I understand this correctly the code was changed, requiring me to do a
manual "decode as" to be able to decode Ethernet based MPLS payloads? 

My recommendation would be to check the MPLS payload for IP version nibbles "4"
or "6" being present at payload offset 0 to check if it is IP based payload (I
think this is what Wireshark does right now). 

If there isn't, check if the 16 bit value starting at payload offset 12
(skipping 2x 6 byte MAC addresses) is 0x800, 0x806, 0x8035, 0x8100 or 0x86dd
(IPv4, ARP, RARP, VLAN, IPv6). If so, it's Ethernet over MPLS. There may be
other Ethertypes, but frankly, those are the ones where it makes sense to
decode the layer automatically; everything else can be "decoded as". That's
actually what I do not in TraceWrangler and it works fine so far.

---

      You are receiving this mail because:

• You are watching all bug changes.