Wireshark-users: Re: [Wireshark-users] MPLS over UDP decoding
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 28 Dec 2018 18:38:51 -0800
On Dec 28, 2018, at 2:36 PM, Yang Yu <yang.yu.list@xxxxxxxxx> wrote:

> On Fri, Dec 28, 2018 at 1:07 PM Guy Harris <guy@xxxxxxxxxxxx> wrote:
>> From looking at the code, the logic appears to be "is the traffic to or from UDP port 6635?"
>> 
>> So *is* the traffic to or from UDP port 6635?
> 
> indeed udp.dstport is 6635 (IANA assigned for mpls-udp), so it turned
> out a host was using udp/6635 as ephemeral port to connect to a STUN
> server

So, for this case, follow Hugo van der Kooij's suggestion and disable the MPLS dissector.