Wireshark-dev: [Wireshark-dev] Ethernet header below MPLS...
From: barcaroller <[email protected]>
Date: Thu, 15 Sep 2016 19:13:49 -0400
I have a pcap file where, in each packet, the header hierarchy is as follows:

ETH
  IP
    GRE
      MPLS
        ETH  <--- ?
          VLAN
            IP
              TCP/UDP


I would not expect to see an Ethernet header right below an MPLS header. And yet wireshark was able to properly identify/parse the headers, even though there's no indication in the MPLS header that the following header is Ethernet. How did wireshark do that?