THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
0

Is there a plug-in showing MPLS statistics?

  • retag add tags

Hello, Is there a plug-in for Wireshark which can show MPLS statistics? For instance list of all the labels found with a number of appearances, number of packets with 1,2 or 3 labels in the stack, etc.

Thanks a lot, Slawek

Slaw_k's avatar
3
Slaw_k
asked 2021-08-19 22:00:47 +0000
cmaynard's avatar
11.1k
cmaynard
updated 2021-08-23 14:43:51 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

0

I am not aware of a plugin. Depending on your requirements, you might get away with the command line tool tshark. For starters, try this:

tshark -r "mytrace.pcapng" -T fields -e mpls.label -Y "mpls"

A few comments, in case you (or another reader) are not familiar with tshark:

  • -r mytrace.pcapng is obviously the capture file name
  • -T fields tells tshark to extract the content of certain fields
  • -e mpls.label is the desired field. This will print the whole label stack, like 21,22
  • -Y mpls is the display filter used to process the file. This makes sure, that you don't have empty lines (caused by packets without MPLS label stack) in the output.

If you want to focus on an individual label you can work with the tshark option -z

 -z io,stat,0,"COUNT(frame)frame"

Specify a filter, say -Y "mpls.label==21" to get the number of packets with an MPLS label 21.

The documentation tells me, that the command line option -q should suppress the packet decode for all lines. For a reason unknown to me, my tshark 3.4.7 insists on printing all lines, when I combine -z with -q.

Good luck

Eddi

Eddi's avatar
2.4k
Eddi
answered 2021-08-22 08:51:25 +0000
edit flag offensive 0 remove flag delete link

Comments

p$ tshark  -q -r ./mpls-basic.cap -z io,stat,0,"COUNT(frame)mpls.label==29"

=====================================
| IO Statistics                     |
|                                   |
| Duration: 24.5 secs               |
| Interval: 24.5 secs               |
|                                   |
| Col 1: COUNT(frame)mpls.label==29 |
|-----------------------------------|
|              |1      |            |
| Interval     | COUNT |            |
|----------------------|            |
|  0.0 <> 24.5 |    17 |            |
=====================================


(capture file available here: wikis/SampleCaptures

Chuckc's avatar Chuckc (2021-08-22 15:11:54 +0000) edit
add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer