Pcap.Net and MPLS Headers

Aug 12, 2011 at 8:45 AM

Hi,

 With pcap.net I have managed to work out how to parse a standard packet with the Ethernet -> IP -> TCP/UDP headers and then extract the fields from each of these.

 I have now been trying to parse packets with Ethernet -> MPLS -> MPLS -> Ethernet -> IP -> TCP/UDP headers and so far have not been able to parse past the first Ethernet header.

 Pcap.net seems to recognise in the first Ethernet header that the “Ethernet Type” is “MultiprotocolLabelSwitchingUnicast” but after this the remaining octets are all then parsed into the IP layer and the MPLS headers are ignored.

 So, questions: -

 Does pcap.net support MPLS headers?

 If so can you explain how I can make pcap.net recognise the MPLS headers so I can parse out all the layers correctly?

 If not, are there any plans to make pcap.net support MPLS headers in the future?

 Regards,

Brownee

 

Coordinator
Aug 12, 2011 at 8:47 PM

Hi brownee,

 

Pcap.Net currently doesn't support MPLS headers.

What you can currently do is either try and parse the MPLS parts yourself by parsing the Ethernet payload or try and extend Pcap.Net to support MPLS.

Either way, I suggest adding an issue in the Issue Tracker and request support of MPLS headers there.

Please also attach example packets (.pcap file) so it will be easier to understand what needs to be supported.

 

I hope this helps,

 

Boaz.

Aug 12, 2011 at 10:24 PM

Hi Boaz,

 Thanks for your prompt reply.

 I have found pcap.net to be an excellent product so far but to complete my project I really need to be able to handle MPLS headers so I will add an issue in the Issue Tracker and request support of MPLS headers there. I also have an example in a pcap file which I will attach with this.

 Thanks for your help.

Brownee

 

Aug 13, 2011 at 9:42 PM

 

Hi Boaz,

 I have been trying to manually parse these packets with MPLS headers but with little success so far.

 Currently I have been parsing the layers with the following statements: -

  • Dim eth As EthernetDatagram = packet.Ethernet
  • Dim ip As IpV4Datagram = packet.Ethernet.IpV4
  • Dim tcp As TcpDatagram = packet.Ethernet.IpV4.Tcp
  • Dim udp As UdpDatagram = packet.Ethernet.IpV4.Udp

 This works fine for a packet that has the layer architecture of Ethernet -> IP -> TCP/UDP. Pcap.net understands the layer boundaries and parses the layers correctly

But I now have this situation of packet layer architecture of Ethernet -> MPLS -> MPLS -> Ethernet -> IP -> TCP/UDP and pcap.net will no longer parse the layers correctly when using these statements.

I have been exploring ways of making pcap.net parse out the IP layer correctly with these MPLS packets but so far with no success.

With these MPLS packets I know where the layer boundaries are, so my question is: -

Is there a way I can correctly parse the IP layer by instructing pcap.net to parse at a certain octet boundary/position?

If I could do this I could load the correct octets to the IP object there by exposing all the IP properties correctly.

Or is there is another way that you can recommend to do this?

Regards,

Brownee

 

Coordinator
Aug 19, 2011 at 5:32 AM

Hi Brownee,

 

You can trying a trick that might work.

Try to build a new packet containing the original packet's data from the beginning of the inner Ethernet layer.

This might work, but I don't know MPLS well enough to be sure.

 

Boaz.

Aug 21, 2011 at 9:06 AM

Hi Boaz,

 I have been working on this for the last week or so and have actually taken the same tact you have recommended.

 What I have done is taken the original pacp.net packet object (packet) and read out the buffer to another byte array by using the “System.Buffer.BlockCopy ” command: -

 Dim arrPointer As Integer = 14

Do

'check S bit in each MPLS header

If (CInt(packet.Buffer(arrPointer + 2)) And 1) = 0 Then

'more MPLS tags

arrPointer = arrPointer + 4

Else

'no more mpls tags

arrPointer = arrPointer + 4

Exit Do

End If

Loop

 

'store original Ethernet layer with mpls headers

Dim p(arrPointer + 13) As Byte

System.Buffer.BlockCopy(packet.Buffer, 0, p, 0, arrPointer + 14)

Dim shb As New SoapHexBinary(p)

LinkOctets.Append(shb.ToString)

 

'build a new packet object with a standard 14 octet Ethernet layer

Dim rp((packet.Buffer.Length - 1) - arrPointer) As Byte

System.Buffer.BlockCopy(packet.Buffer, arrPointer, rp, 0, (packet.Buffer.Length - 1) - arrPointer)

myStdPacket = New Packet(rp, packet.Timestamp, DataLinkKind.Ethernet)

myEth = myStdPacket.Ethernet

 What I have now is a new packet object called “myStdPacket”. The Ethernet layer has now been modified to a standard 14 octet header without the MPLS headers but the remaining layers (IP, TCP/UDP, and payload) remain in their original form.

 Pcap.net is know able to handle this packet and expose all its various methods and properties.

 I have still kept the original Ethernet layer with the MPLS headers in the stringbuilder object called “LinkOctets”.

 So far this does seem to be working for me.

 

Regards,

Brownee

 

Coordinator
Aug 21, 2011 at 4:36 PM

Hi Brownee,

 

I'm glad it worked out for you.

Thanks for posting the code so other people can use it.

 

Boaz.