Wireshark · Wireshark-users: [Wireshark-users] MPLS over UDP decoding

[Yang Yu <yang.yu.list@xxxxxxxxx>]

Hi,

In a packet capture of sFlow export packets, I noticed some sFlow
samples were decoded as MPLS over UDP. The sFlow sampled packet was
actually just a UDP VoIP packet with no dissector support.

What logic does Wireshark use to opportunistically consider UDP
payload to be MPLS? Thanks.

Flow sample
Raw Packet header
  * Ethernet
  * IP
  * UDP
  * MPLS label x 6
  * pweth.cw
  * eth (data looks wrong because it is not an actual Ethernet header)
  * data (unable to decode)


Yang