On Dec 27, 2018, at 3:01 PM, Yang Yu <yang.yu.l...@gmail.com> wrote: > In a packet capture of sFlow export packets, I noticed some sFlow > samples were decoded as MPLS over UDP. The sFlow sampled packet was > actually just a UDP VoIP packet with no dissector support. > > What logic does Wireshark use to opportunistically consider UDP > payload to be MPLS?
From looking at the code, the logic appears to be "is the traffic to or from UDP port 6635?" So *is* the traffic to or from UDP port 6635? ___________________________________________________________________________ Sent via: Wireshark-users mailing list <wireshark-users@wireshark.org> Archives: https://www.wireshark.org/lists/wireshark-users Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-requ...@wireshark.org?subject=unsubscribe
