# MPLS support for Bro

**URL:** <https://community.zeek.org/t/mpls-support-for-bro/1225>\
**Category:** Zeek\
**Created:** [September 18, 2007, 11:28am UTC](https://community.zeek.org/t/mpls-support-for-bro/1225 "2007-09-18T11:28:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Fabian\_Schneider](https://avatars.discourse-cdn.com/v4/letter/f/90db22/32.png) [@Fabian\_Schneider](https://community.zeek.org/u/Fabian_Schneider)\
**Post date:** [September 18, 2007, 11:28am UTC](https://community.zeek.org/t/mpls-support-for-bro/1225/1 "2007-09-18T11:28:07Z")

</div>

Hi,

is there a chance to get MPLS support into bro? Since we are going to analyze MPLS links with Bro we would be very interested in getting that.

We would need to add a link type in get\_link\_header\_size for PPP\_SERIAL (header length 0), and enable bro to read MPLS packets.

The problem of MPLS is that there can be multiple MPLS labels per packet. Thus a per packet loop through the stack of MPLS labels would be required.  
Perhaps it would even be interesting to keep that information for analysis purposes.

This is how MPLS works (from wikipedia):

Each label stack entry contains four fields:

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\* a 20-bit label value.  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\* a 3-bit field for QoS (Quality of Service) priority (experimental).  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\* a 1-bit bottom of stack flag. If this is set, it signifies that the current label is the last in the stack.  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\* an 8-bit TTL (time to live) field.

&nbsp;&nbsp;&nbsp;&nbsp;bye  
&nbsp;&nbsp;&nbsp;&nbsp;Fabian

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [September 19, 2007, 3:01am UTC](https://community.zeek.org/t/mpls-support-for-bro/1225/2 "2007-09-19T03:01:51Z")

</div>

Should be pretty easy to add. Can you send me a short trace with  
MPLS packets (ideally with varying stacking depths)?

Robin

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/mpls-support-for-bro/1225/3 "2022-05-06T15:38:21Z")

</div>


