--- Begin Message ---
On May 5, 2020, at 11:36 AM, Gert Doering via tcpdump-workers 
<tcpdump-workers@lists.tcpdump.org> wrote:

> So, given that the first 16 bits are "4 bit always 0, and 12 bits
> reserved-must-be-set-to-0", using these as heuristics for "if two 0-bytes
> are following the MPLS headers, it's a control word, so we skip 4 bytes
> and the rest is a regular Ethernet packet" should work.

Wireshark looks only at the uppermost nibble, as per my earlier mail, probably 
to make it "future-proof" against the reserved bits being used later.

However, it also has the "do the upper three octets, and the three octets thee 
octets after that, look like OUIs" test.

(Note that 00:00:0C is Cisco, so "two 0 bytes following the MPLS headers" isn't 
*guaranteed* to work as a way of identifying control words.  Wireshark's manuf 
file also shows 00:00:17 as being Oracle, 00:00:0F as being NeXT so that may 
now be used by Apple if NeXT didn't use it up, and 00:00:F0 is Samsung 
Electronics, so there might be others in that range.)

--- End Message ---
tcpdump-workers mailing list

Reply via email to