Hi Keith! I left the full message you sent me for the benefit of everyone on the bro-dev mailing list.
I just pushed a branch to our git repository that has more complete support for MPLS. I'd appreciate it if you could try it. I added some functionality to it that the patch in the tracker doesn't have.
* Supports MPLS over Ethernet (which is likely what you're sniffing).
* Builds the appropriate BPF filter so that MPLS encapsulated and non-encapsulated traffic is sent through.
You just need to make sure and load the mpls.bro script. It *should* just work from that point (no filters to add or anything). If you define your own filter on the command line (with the -f flag), then the auto mpls support will not work. You will have to define the appropriate mpls filter in that case.
If this works for you, then you can have your intern work on something else. Let us know if you have staff time needing projects to work on, I'm sure we can figure something out.
git clone git://git.icir.org/bro
git checkout origin/topic/seth/mpls (ignore all of the warnings)
<do the normal build and install stuff>