Wireshark-users: Re: [Wireshark-users] MPLS over UDP decoding
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Yang Yu <yang.yu.list@xxxxxxxxx>
Date: Fri, 28 Dec 2018 14:36:18 -0800
On Fri, Dec 28, 2018 at 1:07 PM Guy Harris <guy@xxxxxxxxxxxx> wrote:
> From looking at the code, the logic appears to be "is the traffic to or from UDP port 6635?"
>
> So *is* the traffic to or from UDP port 6635?

indeed udp.dstport is 6635 (IANA assigned for mpls-udp), so it turned
out a host was using udp/6635 as ephemeral port to connect to a STUN
server
https://github.com/wireshark/wireshark/blob/075785bd20cad395141481a8a9639022bb963aee/services#L4843
https://github.com/wireshark/wireshark/blob/1539e455d70c5f340ce80021c770b8f992051ec2/epan/dissectors/packet-mpls.h#L67


Thanks a lot.