What is MPLS and how does label switching work?

MPLS, or Multiprotocol Label Switching, forwards packets using short fixed labels instead of a full IP route lookup at every router. The first router assigns a label, routers along the path swap it, and the last one removes it. MPLS can separate customer traffic on shared links, but it does not encrypt anything.

Why was MPLS invented?

RFC 3031 describes the architecture. The idea is to make the expensive decision once, at the edge of the network, and keep the core simple. The ingress router looks at a packet, decides which forwarding equivalence class (FEC) it belongs to, and attaches a label. Every router after that only reads the label.

A forwarding equivalence class is just a group of packets that will be treated the same way, for example "all traffic for this destination prefix" or "all traffic for this customer's VPN".

What does a label actually look like?

RFC 3032 defines the encoding. Each label stack entry is 32 bits: a 20 bit label value, a 3 bit field originally called Exp (later repurposed for traffic class), a 1 bit bottom of stack flag, and an 8 bit TTL. The entry sits after the link layer header and before the IP header, which is why people call MPLS a "layer 2.5" technology.

Labels can be stacked. A carrier might push an outer label that carries the packet across its backbone and keep an inner label that identifies the customer.

How does a packet cross an MPLS network?

Take a constructed example: a company with offices in three cities buys a carrier VPN.

1. A packet leaves the Leeds office for Bristol and reaches the carrier's edge router.
2. The edge router matches it to a FEC, pushes a label and sends it on.
3. Each core router looks the incoming label up in its table, swaps it for a new one and forwards it. This is label swapping, and the resulting route is a label switched path (LSP).
4. Near the end, the second to last router usually removes the outer label. RFC 3031 calls this penultimate hop popping. It saves the last router a lookup.
5. The egress router delivers the packet to the Bristol office.

The core routers never needed the customer's IP routes. That is the point.

How do MPLS VPNs keep customers apart?

RFC 4364 describes BGP/MPLS VPNs. The provider's edge routers keep a separate virtual routing table (a VRF) for each customer. A route distinguisher makes overlapping customer addresses unique inside the carrier's BGP, so two customers can both use 10.0.0.0/8 without colliding. Route targets control which sites may exchange routes.

RFC 4364 is clear about the limit. The methods "do not by themselves encrypt the data for privacy, nor do they provide a way to determine whether data has been tampered with en route." If you need that, you add cryptography, such as IPsec, on top.

Is MPLS secure?

It is isolated, not confidential. Isolation depends on the carrier configuring VRFs and route targets correctly and on nobody being able to inject labeled packets from outside. Your traffic crosses equipment you do not own and staff you cannot audit. Treat the carrier like any other third party.

How to check or apply this

1. Ask the carrier how your VPN is separated (VRF per customer) and who can change that configuration.
2. Decide whether your data classification allows unencrypted transit over a shared backbone. If not, encrypt site to site traffic yourself.
3. Check that your edge devices do not accept labeled packets from the internet side.
4. Keep an inventory of which applications depend on carrier quality of service markings, since those can be lost in a migration.
5. Log and review changes to routing policy at the customer edge.

Quick check

Sources

• RFC 3031, Multiprotocol Label Switching Architecture
• RFC 3032, MPLS Label Stack Encoding
• RFC 4364, BGP/MPLS IP Virtual Private Networks

Last reviewed: 18 October 2026.