-1

I have a pcap with two MPLS headers . i observe the match criteria for every field in both the MPLS headers are similar . How do I differentiate between the two MPLS headers ? Is it possible to achieve this via Wireshark or tshark ? If it is possible to achieve via tshark , please share the linux cmd.

For example , i am trying to filter using -

mpls.exp==7 && mpls.bottom == 0

but with the above match filter criteria , even those packets where mpls.exp==7 (in header1) and mpls.bottom==0 (in header 2) are matched. Attaching pcap snip for your reference.

above match criteria matching exp from header 1 and bottom of stack from header 1

above match criteria matching exp from header 2 and bottom of stack from header 1 TIA.

Tried to filter this using tsahrk in linux . Still not able to get the desired result -

Expected result - only the first 8 packets only should be matched Observed result - 16 packets are matched

Tshark cmd :

tshark -r capture2_11-17-2022_11-15-15.pcap -T fields -E header=y -e mpls.exp -e mpls.bottom mpls.bottom==0 and mpls.exp==7

tshark output table

Gilles Quénot
  • 173,512
  • 41
  • 224
  • 223
Giridhar Radhakrishnan
  • 1
  • 2

1 Answers1

1

2nd EDIT: I thought of an alternative solution, which I'll now describe here. (Note that I would have provided this alternative solution, which involves programming in the form of a Lua script, as a separate answer, but it seems folks were a little trigger-happy in closing this question, so I have no choice but to supply it here. If the question is reopened, which I've voted to do, I can make this a separate answer.)

What you can do is create an MPLS Lua postdissector that adds new mpls_post.exp and mpls_post.bottom fields to an MPLS postdissector tree. You can then use those new fields in your filter to accomplish your goal. As an example, consider the following Lua postdissector:

local mpls_post = Proto("MPLSPost", "MPLS Postdissector")

local pf = {
    expbits = ProtoField.uint8("mpls_post.exp", "MPLS Experimental Bits", base.DEC),
    bottom = ProtoField.uint8("mpls_post.bottom", "MPLS Bottom of Label Stack", base.DEC)
}
mpls_post.fields = pf

local mpls_exp = Field.new("mpls.exp")
local mpls_bottom = Field.new("mpls.bottom")

function mpls_post.dissector(tvbuf, pinfo, tree)

    local mpls_exp_ex = {mpls_exp()}
    local mpls_bottom_ex = {mpls_bottom()}

    if mpls_exp_ex == nil or mpls_bottom_ex == nil then
        return
    end

    local mpls_post_tree = tree:add(mpls_post)
    mpls_post_tree:add(pf.expbits, mpls_exp_ex[1].range, mpls_exp_ex[1].value)
    mpls_post_tree:add(pf.bottom, mpls_bottom_ex[1].range, mpls_bottom_ex[1].value)

end

register_postdissector(mpls_post)

If you save this to a file, e.g. mpls_post.lua and place that file in your Wireshark Personal Lua Plugins directory, which you can find from "Help -> About Wireshark -> Folders" or from tshark -G folders, then [re]start Wireshark, you will be able to apply a filter such as follows:

mpls_post.exp==7 && mpls_post.bottom == 0

You can also use tshark to do the same, e.g.:

    tshark -r capture2_11-17-2022_11-15-15.pcap -Y "mpls_post.exp==7 && mpls_post.bottom==0" -T fields -E header=y -e mpls_post.exp -e mpls_post.bottom

(NOTE: The tshark command, as written, will simply print out what you already know, namely 7 and 0, so presumably you want to print more than just that, but this is the idea.)

I think this is probably the best that can be done for now until the Wireshark MPLS dissector is modified so that layer operators work as expected for this protocol, but there are no guarantees that any changes to the MPLS dissector will ever be made in this regard.

EDIT: I'm sorry to say that the answer I provided doesn't actually work for MPLS. It doesn't work because the MPLS dissector is only called once and it then loops through all labels as long as bottom of stack isn't true, but it doesn't call itself recursively, which is what would be needed in this case in order for the second label to be considered another layer. The layer syntax does work for other protocols such as IP (in the case of tunneled traffic or ICMP error packets) and others though, so it's a good thing to keep in mind, but unfortunately it won't be of much use for MPLS, at least not in the Wireshark MPLS dissector's current state. I suppose I'll leave the answer up [for now] in case the dissector is ever changed in the future to allow for the layer syntax to work as one might intuitively expect it to work. And unfortunately, I can't think of an alternative solution to this problem at this time.

With Wireshark >= version 4.0, you can use the newly introduced syntax for matching fields from specific layers. So, rather than specifying mpls.exp==7 && mpls.bottom == 0 as the filter, which matches fields from any layer, use the following syntax instead, which will only match against fields from the first layer:

mpls.exp#1 == 7 && mpls.bottom#1 == 0

Refer to the Wireshark 4.0.0 Release Notes for more details about this new syntax as well as for other display filter changes, and/or to the wireshark-filter man page.

NOTE: You can also achieve this with tshark, although you can't [yet] selectively choose which field is displayed. For example:

tshark -r capture2_11-17-2022_11-15-15.pcap -Y "mpls.exp#1 == 7 && mpls.bottom#1 == 0" -T fields -E header=y -e mpls.exp -e mpls.bottom

To be clear, you can't [yet] specify -e mpls.exp#1 and -e mpls.bottom#1.

Christopher Maynard
  • 5,702
  • 2
  • 17
  • 23