Ettercap/ettercap — pull request #172 by jacob-baines (2013-04-06 13:03:56+00:00)
Title: Fixed MPLS End of Stack Bit Checking

Description: ec_mpls.c checks the end of stack bit in order to figure out if there is another MPLS label or if it can forward the data to IP. However, we are currently checking the wrong bit (it appears the mask is applied as if the data is in host order). This is most apparent when there is more than one label in the stack.

Recreate Look at Wireshark's sample capture mpls-twolevel.cap (http://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=get&target=mpls-twolevel.cap). If you filter mpls only data you can see that packets make it to IP but the data pointer is pointing to the second mpls label.