MPLS support for Bro

Hi,

is there a chance to get MPLS support into bro? Since we are going to analyze MPLS links with Bro we would be very interested in getting that.

We would need to add a link type in get_link_header_size for PPP_SERIAL (header length 0), and enable bro to read MPLS packets.

The problem of MPLS is that there can be multiple MPLS labels per packet. Thus a per packet loop through the stack of MPLS labels would be required.
Perhaps it would even be interesting to keep that information for analysis purposes.

This is how MPLS works (from wikipedia):

Each label stack entry contains four fields:

     * a 20-bit label value.
     * a 3-bit field for QoS (Quality of Service) priority (experimental).
     * a 1-bit bottom of stack flag. If this is set, it signifies that the current label is the last in the stack.
     * an 8-bit TTL (time to live) field.

    bye
    Fabian

Should be pretty easy to add. Can you send me a short trace with
MPLS packets (ideally with varying stacking depths)?

Robin