Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: [Wireshark-dev] Ethernet header below MPLS...

From: barcaroller <barcaroller@xxxxxxxxx>
Date: Thu, 15 Sep 2016 19:13:49 -0400
I have a pcap file where, in each packet, the header hierarchy is as follows:

ETH
� IP
� � GRE
� � � MPLS
� � � � ETH �<--- ?
� � � � � VLAN
� � � � � � IP
� � � � � � � TCP/UDP


I would not expect to see an Ethernet header right below an MPLS header. And yet wireshark was able to properly identify/parse the headers, even though there's no indication in the MPLS header that the following header is Ethernet. How did wireshark do that?