[Bro] MPLS support for Bro

Fabian Schneider fabian at net.t-labs.tu-berlin.de
Tue Sep 18 04:28:07 PDT 2007


is there a chance to get MPLS support into bro? Since we are going to 
analyze MPLS links with Bro we would be very interested in getting that.

We would need to add a link type in get_link_header_size for PPP_SERIAL 
(header length 0), and enable bro to read MPLS packets.

The problem of MPLS is that there can be multiple MPLS labels per packet. 
Thus a per packet loop through the stack of MPLS labels would be required.
Perhaps it would even be interesting to keep that information for analysis 

This is how MPLS works (from wikipedia):

Each label stack entry contains four fields:

     * a 20-bit label value.
     * a 3-bit field for QoS (Quality of Service) priority (experimental).
     * a 1-bit bottom of stack flag. If this is set, it signifies that the 
current label is the last in the stack.
     * an 8-bit TTL (time to live) field.


Fabian Schneider, An-Institut Deutsche Telekom Laboratories
Technische Universität Berlin, Fakultät IV -- Elektrotechnik und Informatik
address: Sekr. TEL 4, FG INET, Ernst-Reuter-Platz 7, 10587 Berlin
e-mail: fabian at net.t-labs.tu-berlin.de, WWW: http://www.net.in.tum.de/~schneifa
phone: +49 30 8353 - 58513, mobile: +49 160 479 43 97

More information about the Bro mailing list