Filter on IP field does not work when MPLS is present. #1070
tcpdump version 4.9.3
I have experienced some weird behaviour when trying to match to
So far, so good. And as you can see, for both packets it parses the
Ok, I thought I need to extend the filter to have mpls && ip==0 or ip==0. So if i try that... for some reason I am only getting the
However, if I if keep the same filter, but I reverse the logical expression it does work, like why?? I am missing something, is this a bug? See below:
Is there any difference between the last two expressions? I could not find anything in the documentation.
The text was updated successfully, but these errors were encountered:
And thanks for the reply. I am not sure I understood it properly even after reading those other issues and mpls option. If I understood properly, every time you use the keyword
So I still have the following questions?
Thanks a lot!
Edit: Could it be that to do what i want I have to do :
This will either do normal IP packets, or 1 label, 2, 3, 4, 5, 6, etc...? Isnt there a way to do this simpler?
If you want to understand the filters, the pcap-filter man page would be the first reference material (that said, if you spot a valid place for improvement there, please contribute it).
This might make more sense if you consider that pcap filters work in libpcap, often in the OS kernel, and the packet decoding you see works in tcpdump, in a mostly independent manner. That is, what tcpdump knows about MPLS label stack and the data before and after it does not depend on what libpcap knows about MPLS label stack and the data before and after it.