79681685

Date: 2025-06-27 09:17:22
Score: 1.5
Natty:
Report link

I noticed this as well, and in my case it was MPLS encapsulated vlan frames, which things like wireshark/tcpdump can't analyze because MPLS doesn't include a specification for the payload type, nor does it GUARANTEE the payload starts with an ethertype... So when it's a ethertype 0x8100 encapsulated inside another it doesn't know what it is .. there's no mandate in MPLS that the encapsulated data has to start with this so it can't just look for it, otherwise it could find an IP packet that just happens to have 0x8100 in the data ..

Boo on MPLS for not including it.. You can force wireshark to debug it by setting assume payload = ethernet.

So in my case:
MPLS Label Stack Has No Payload Type Field
Pseudowire Payload is a Raw Ethernet Frame
Ingress VLAN Tag Popped but Reinserted in PW Payload (transport-mode vlan)

Reasons:
  • Long answer (-0.5):
  • No code block (0.5):
  • Unregistered user (0.5):
  • Low reputation (1):
Posted by: f00