--- Begin Message ---Hi, On Tue, May 05, 2020 at 07:28:28PM +0200, Francois-Xavier Le Bail wrote: > On 05/05/2020 12:15, Gert Doering via tcpdump-workers wrote: > > In my case, there is an MPLS control word before the ethernet header > > ("0000 0000"), and if I skip that and just clear "ethernet in here", I > > get nicely printed packets... > > It seems it is like: > https://tools.ietf.org/html/rfc4448#section-4.6 > > Can you confirm?This very much looks like it, indeed. So, given that the first 16 bits are "4 bit always 0, and 12 bits reserved-must-be-set-to-0", using these as heuristics for "if two 0-bytes are following the MPLS headers, it's a control word, so we skip 4 bytes and the rest is a regular Ethernet packet" should work. Thanks for digging up that reference :) gert -- "If was one thing all people took for granted, was conviction that if you feed honest figures into a computer, honest figures come out. Never doubted it myself till I met a computer with a sense of humor." Robert A. Heinlein, The Moon is a Harsh Mistress Gert Doering - Munich, Germany g...@greenie.muc.de
--- End Message ---
_______________________________________________ tcpdump-workers mailing list tcpdump-workers@lists.tcpdump.org https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
