On Fri, Dec 28, 2018 at 1:07 PM Guy Harris wrote:
> From looking at the code, the logic appears to be "is the traffic to or from
> UDP port 6635?"
>
> So *is* the traffic to or from UDP port 6635?
indeed udp.dstport is 6635 (IANA assigned for mpls-udp), so it turned
out a host was using udp/6635
Hi,
In a packet capture of sFlow export packets, I noticed some sFlow
samples were decoded as MPLS over UDP. The sFlow sampled packet was
actually just a UDP VoIP packet with no dissector support.
What logic does Wireshark use to opportunistically consider UDP
payload to be MPLS? Thanks.
Flow sa
