If I understand correctly, the MPLS dissector inspects the rest of the ethernet payload to determine what type it is. If it is encrypted or corrupted, it will randomly match various types which impacts my analysis.
It seems like a 'do not decode MPLS payload at all' feature was over looked. So, does this sound like a feature request or have I overlooked a way of handling this? asked 28 Jul '15, 19:00 Guy Gangemi |
One Answer:
Going to Preferences > Protocols > MPLS and setting Default decoder won't work for reasons outlined above. Decode as... > Link won't work because the Ethertype is parsed from the payload which means it's effectively a random value. Decode as... > MPLS will work because, in my case, mpls.label is a constant value. However, the inbuilt Data dissector isn't present in the list so I added one using LAU. The LAU file is quite simple:
I followed the Wireshark guide here to enable LAU. Now I can find Data in the Decode as... > MPLS list and selecting it results in the MPLS payload presented as generic data. answered 29 Jul '15, 20:11 Guy Gangemi |