Packet Captures

EoMPLS.cap 7.0 KB

Submitted Oct 12, 2009 by pierky

Routers at 1.1.2.1 and 1.1.2.2 are PEs in a MPLS cloud. LDP starts at packet 8 and they build up a pseudo-wire VC (last FEC in packets 11 and 13). At packet 15 we already have STP running between CE1 and CE2 (two routers with ESW), encapsulated in 2 MPLS headers. All the ethernet stuff follows: CDP, ARP, ICMP between two hosts on the same subnet.

Ethernet IP LOOP MPLS TCP UDP

EoMPLS_802.1q.pcap.cap 1.6 KB

Submitted Dec 5, 2009 by pierky

ICMP over EoMPLS with 802.1q tagging

Ethernet MPLS

Frame-Relay over MPLS.pcap.cap 1.4 KB

Submitted Dec 5, 2009 by pierky

ICMP on a Frame-relay over MPLS link. If Wireshark doesn't understand it's FR, right click on a packet, select "Decode as" from the menu and select "Frame Relay DLCI PW" on the "MPLS" tab.

Ethernet MPLS

LDP_Ethernet_FrameRelay.pcap.cap 2.1 KB

Submitted Dec 5, 2009 by pierky

LDP with pseudowire FEC elements (Ethernet and Frame-Relay DLCI-to-DLCI)

Ethernet IP LDP MPLS TCP UDP

LDP_adjacency.cap 5.7 KB

Submitted Sep 14, 2009

PE1 and P1 multicast LDP hellos to 224.0.0.2 on UDP port 646. They then establish an adjacency on TCP port 646 and exchange labels.

Ethernet IP LDP TCP UDP

MPLS_encapsulation.cap 1.3 KB

Submitted Sep 14, 2009

Capture taken from the PE1-P1 link. ICMP traffic between CE1 and CE2 is encapsulated outbound with MPLS label 18. Note that returning traffic is not labeled, due to penultimate hop popping (PHP).

Ethernet ICMP IP MPLS

address withdrawal ldp.pcapng.cap 716 bytes

Submitted Apr 25, 2014 by altafk

Label address withdrawal message. An LSR sends the label address withdrawal message to a peer when it wants to withdraw previously advertised labels to address mappings. See RFC 3036 for more details.

IP LDP TCP

mpls address label mapping.pcapng.cap 708 bytes

Submitted Apr 23, 2014 by altafk

MPLS address label mappings communication over TCP (here R6 to R5) In this packet we can see the address bound to that neighbor (R6) in the address list TLV. Also the address and labels are encoded as TLV(type length value). We should remember that the transport address of the neighbor should be reachable and not mpls router ID, because the TCP handshake is done via transport address and not MPLS router id. The address label mapping is exchanged once the TCP handshake is done.

IP LDP TCP

traceroute_MPLS.cap 3.3 KB

Submitted May 14, 2011 by stretch

ICMP IP UDP