MPLS Labels Explained: Format, Stacking, and Penultimate Hop Popping

MPLS labels are 32-bit shim headers inserted between the data link layer and the IP header. They carry the label value, traffic class (formerly EXP), the bottom-of-stack bit, and TTL. Multiple labels can be stacked. If you understand the label format and how the stack works, the rest of MPLS becomes mechanics.

This article walks through the byte-level format, the label stack, special reserved labels, Penultimate Hop Popping (PHP), and how labels look on the wire in real packet captures. If you are studying for CCIE Service Provider, troubleshooting an MPLS-VPN packet, or trying to figure out why show mpls forwarding-table shows what it shows, this is the byte reference.

The Label Format

+---------------------+-----+---+-------------+
|        Label        | EXP | S |     TTL     |
| 20 bits             | 3   | 1 | 8 bits      |
+---------------------+-----+---+-------------+

Total 32 bits = 4 bytes per label. The shim header is inserted in the frame between the Layer 2 header (Ethernet, etc.) and the Layer 3 payload (IP).

Reserved Labels

The first 16 label values (0-15) are reserved for special meanings. Three matter in practice:

Labels 16 to 1,048,575 are available for use as forwarding labels. Different platforms may reserve some additional ranges (e.g. Cisco IOS reserves the first ~16,000 for specific features), so customer-installed labels typically start at 16,000 or higher.

The Label Stack

Multiple labels can be pushed onto a single packet. The stack is a sequence of label entries with the S bit indicating which is the bottom. Reading from outer to inner:

+--------+--------+--------+---------+
| Outer  | Middle | Inner  | IP/payld|
| S=0    | S=0    | S=1    |         |
+--------+--------+--------+---------+
   First popped or swapped
                         Last popped, payload exposed

Common scenarios:

Each LSR along the path looks at the outermost label, performs swap/pop/push as configured, and forwards. P routers in the core typically only swap the outer transport label. The inner labels are invisible to them.

Label Actions: Push, Swap, Pop

Each LSR can perform three operations on the label stack:

The forwarding table entry tells the LSR which action to perform for each (incoming label, incoming interface) tuple. Verify with:

R1# show mpls forwarding-table
Local      Outgoing   Prefix          Bytes Label   Outgoing   Next Hop
Label      Label      or Tunnel Id    Switched      interface
17         18         10.10.10.0/24   123456       Gi0/0/1     10.0.12.2
18         Pop Label  10.20.20.0/24   78901        Gi0/0/2     10.0.13.3
19         No Label   10.30.30.0/24   45678        Gi0/0/0     10.0.14.4

"Pop Label" means PHP - this LSR pops the label and forwards the unlabeled packet. "No Label" means the next hop is not running MPLS for this prefix.

Penultimate Hop Popping (PHP)

The egress PE has the work of looking up which VRF a customer packet belongs to (based on the inner VPN label) and forwarding it to the customer. If it also had to look up the outer transport label, that is two label lookups instead of one.

Penultimate Hop Popping optimizes this. The penultimate (second-to-last) LSR pops the outer label before forwarding to the egress PE. The egress PE receives a packet with only the inner VPN label, performs one label lookup, and forwards to the customer.

Signaling: the egress PE advertises label "implicit null" (label 3) to its upstream neighbors via LDP. This is a request to pop the label rather than swap it. The penultimate router sees implicit null in the LDP table and pops accordingly.

PHP is enabled by default in most Cisco IOS XE deployments. Verify with:

P1# show mpls forwarding-table 10.10.10.10 32
Local      Outgoing   Prefix          Bytes Label   Outgoing   Next Hop
Label      Label      or Tunnel Id    Switched      interface
17         Pop Label  10.10.10.10/32  123456       Gi0/0/2     10.0.PE2.PE2

The "Pop Label" outgoing label confirms PHP for the egress PE's loopback (10.10.10.10/32).

Disable PHP if you want the egress PE to see the outer label (e.g. to preserve EXP/TC bits across the boundary):

! On the egress PE
mpls ldp explicit-null

This advertises "explicit null" (label 0 for IPv4, label 2 for IPv6) instead of implicit null. The penultimate router still pops one level of stack, but the egress PE sees an explicit null label - useful for QoS preservation.

TTL Handling

The MPLS label has its own TTL. Two modes for handling it at ingress and egress:

Uniform mode lets traceroute work as expected through the MPLS network - each LSR appears as a hop. Pipe mode hides the MPLS topology - the customer sees one big "hop" across the entire MPLS network, which is what service providers usually want for security reasons.

Configure with:

! Pipe mode (hide MPLS topology)
mpls ip propagate-ttl no

! Uniform mode (default; show MPLS topology)
mpls ip propagate-ttl

EtherType and Encapsulation

On Ethernet, an MPLS-encapsulated frame has:

An Ethernet frame with EtherType 0x8847 carries one or more MPLS labels followed by the payload (typically IP). The receiver parses the labels until S=1, then treats the remainder as the underlying protocol.

Show Commands

! All MPLS forwarding entries
Router# show mpls forwarding-table

! For a specific prefix
Router# show mpls forwarding-table 10.10.10.0 24

! LDP-assigned labels per prefix
Router# show mpls ldp bindings

! Per-interface MPLS state
Router# show mpls interfaces

! IP-to-label mapping in CEF
Router# show ip cef 10.10.10.0/24
10.10.10.0/24, version 123, ...
  via 10.0.12.2, GigabitEthernet0/0/0
    push label 17, ...

The CEF output shows the label being pushed for each prefix. This is what actually drives forwarding. LDP populates the binding table; CEF uses the bindings to populate the forwarding-information base; packets follow the FIB.

In a Packet Capture

An MPLS-labeled frame in Wireshark shows as:

Ethernet II, Src: ..., Dst: ..., Type: MPLS (0x8847)
MPLS Label, Exp: 0, S: 0, TTL: 64        <-- outer
    MPLS Label: 17
MPLS Label, Exp: 0, S: 1, TTL: 64        <-- inner (S=1 = bottom)
    MPLS Label: 1234
Internet Protocol Version 4, Src: ..., Dst: ...

Wireshark parses the label stack automatically. The S=1 on the inner label terminates the stack; everything after is parsed as IP (or whatever the inner protocol indicates).

Summary

MPLS labels are 32-bit shim headers (20-bit label, 3-bit EXP/TC, 1-bit S, 8-bit TTL) that sit between the data link header and the payload. Stacks of labels enable services like L3VPN (two-label stack) and traffic engineering. Penultimate Hop Popping optimizes egress PE work by having the second-to-last LSR pop the outer label.

Master the label format, the three actions (push/swap/pop), the reserved labels (especially implicit null for PHP), and the stack model. The rest of MPLS is mechanics built on these foundations. Bookmark this article alongside the MPLS cluster pillar and the LDP article.