MPLS Label Stack Visualizer

MPLS forwards on a label rather than on the IP header. Each router looks up the top label, performs one action, and sends the packet on.

• Push — impose a label. The ingress router does this, and in a VPN it pushes two: the service label first, then the transport label on top.
• Swap — replace the top label with the one the next hop expects. Labels are locally significant, so the value changes at every hop and means nothing on its own.
• Pop — remove the top label.

Penultimate hop popping is the default nearly everywhere. The egress router advertises implicit null — label 3, which never actually travels in a packet — and that tells the router before it to pop the transport label instead of swapping. The last router then receives an unlabelled packet, or in a VPN one carrying only the service label, and does a single lookup instead of two.

Explicit null — label 0 for IPv4, 2 for IPv6 — is the alternative. The label stays on the stack to the very last hop, which preserves the traffic class bits for quality of service. You pay for it with an extra lookup at the egress.

The two-label stack in an L3VPN is the thing worth understanding. The transport label gets the packet across the core and is popped by the penultimate hop. The service label underneath survives, and tells the egress which VRF the packet belongs to. That is why PHP does not break VPNs.