[prev in list] [next in list] [prev in thread] [next in thread] 

List:       tcpdump-workers
Subject:    Re: [tcpdump-workers] MPLS
From:       Hannes Gredler <hannes () juniper ! net>
Date:       2005-06-16 7:46:37
Message-ID: 20050616074637.GA26897 () juniper ! net
[Download RAW message or body]

On Fri, Jun 10, 2005 at 12:07:44PM +0200, Paolo Lucente wrote:
| Hello,
| i wish to share (hoping it might be found of interest) a patch i've
| written for personal use; it merges fine against the daily tarball of
| 09-06-2005 (yesterday). It aims to enhance the actual support for MPLS
| label hierarchies in a BPF filter.
| 
| Actually it's not possible, for example, to match a label ignoring the
| content of the upper ones. The patch allows to write an expression like
| 'mpls 1:100000 and mpls 3:1024' which checks whether the 2nd label has
| value 100000 and the 4th has value 1024 (the top label is meant to be
| 0).

thats does not seem to be correct - i.e.

./tcpdump -ndr ppp.pcap "mpls && mpls && mpls 100000"
reading from file ppp.pcap, link-type PPP (PPP)
(000) ldh      [2]
(001) jeq      #0x281           jt 2    jf 6
(002) ld       [12]
(003) and      #0xfffff000
(004) jeq      #0x186a0000      jt 5    jf 6
(005) ret      #1500
(006) ret      #0

does not compare the MPLS label at position 8 [middle label] and
does not compare the MPLS label at potition 4 [top label] but
does compare the MPLS label at position 12 [bottom label];

---

there is one minor nit with the current code - in case of stacked MPLS
labels it does not verify if the Bottom of Stack bit of the previous
label is cleared;

/hannes
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.
[prev in list] [next in list] [prev in thread] [next in thread]