[Bro] MPLS support for Bro
fabian at net.t-labs.tu-berlin.de
Tue Sep 18 04:28:07 PDT 2007
is there a chance to get MPLS support into bro? Since we are going to
analyze MPLS links with Bro we would be very interested in getting that.
We would need to add a link type in get_link_header_size for PPP_SERIAL
(header length 0), and enable bro to read MPLS packets.
The problem of MPLS is that there can be multiple MPLS labels per packet.
Thus a per packet loop through the stack of MPLS labels would be required.
Perhaps it would even be interesting to keep that information for analysis
This is how MPLS works (from wikipedia):
Each label stack entry contains four fields:
* a 20-bit label value.
* a 3-bit field for QoS (Quality of Service) priority (experimental).
* a 1-bit bottom of stack flag. If this is set, it signifies that the
current label is the last in the stack.
* an 8-bit TTL (time to live) field.
Fabian Schneider, An-Institut Deutsche Telekom Laboratories
Technische Universität Berlin, Fakultät IV -- Elektrotechnik und Informatik
address: Sekr. TEL 4, FG INET, Ernst-Reuter-Platz 7, 10587 Berlin
e-mail: fabian at net.t-labs.tu-berlin.de, WWW: http://www.net.in.tum.de/~schneifa
phone: +49 30 8353 - 58513, mobile: +49 160 479 43 97
More information about the Bro