On Fri, Jun 10, 2005 at 12:07:44PM +0200, Paolo Lucente wrote: | Hello, | i wish to share (hoping it might be found of interest) a patch i've | written for personal use; it merges fine against the daily tarball of | 09-06-2005 (yesterday). It aims to enhance the actual support for MPLS | label hierarchies in a BPF filter. | | Actually it's not possible, for example, to match a label ignoring the | content of the upper ones. The patch allows to write an expression like | 'mpls 1:100000 and mpls 3:1024' which checks whether the 2nd label has | value 100000 and the 4th has value 1024 (the top label is meant to be | 0).
thats does not seem to be correct - i.e. ./tcpdump -ndr ppp.pcap "mpls && mpls && mpls 100000" reading from file ppp.pcap, link-type PPP (PPP) (000) ldh [2] (001) jeq #0x281 jt 2 jf 6 (002) ld [12] (003) and #0xfffff000 (004) jeq #0x186a0000 jt 5 jf 6 (005) ret #1500 (006) ret #0 does not compare the MPLS label at position 8 [middle label] and does not compare the MPLS label at potition 4 [top label] but does compare the MPLS label at position 12 [bottom label]; --- there is one minor nit with the current code - in case of stacked MPLS labels it does not verify if the Bottom of Stack bit of the previous label is cleared; /hannes - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.