PlayInfoBox

Home /Network /What Is MPLS? Multiprotocol Label Switching Explained

What Is MPLS? Multiprotocol Label Switching Explained

The long-standing backbone technology behind carrier and enterprise networks, explained from the ground up.

What MPLS is

MPLS (Multiprotocol Label Switching) attaches a short numeric label to a packet as it first enters a network, and forwards it at every subsequent hop based only on that label rather than re-analyzing the full IP header. It's faster than ordinary routing, which recalculates the best path at every hop by examining the entire IP header, and because it can carry protocols beyond IP, it earned the name 'multiprotocol.'

How label switching actually works

A short label is inserted between the IP header and the data-link header when a packet enters an MPLS network. Devices inside the network forward the packet to a predetermined next hop by reading only that label value, instead of re-examining the full destination IP address. The label is stripped once the packet nears its destination, returning it to an ordinary IP packet.

The different roles of LER and LSR

A Label Edge Router (LER) sits at the entry and exit points of an MPLS network, attaching labels to incoming IP packets (at the entrance) or removing them (at the exit). A Label Switch Router (LSR) sits inside the network and forwards packets to the next device purely based on the label value. Because interior devices never need to re-examine IP addresses, their processing load is lower.

The concept of a Forwarding Equivalence Class (FEC)

An FEC (Forwarding Equivalence Class) is a group of packets that can be treated the same way. For example, packets heading to the same destination range, or traffic needing the same quality of service (QoS), can be grouped into a single FEC and assigned the same label, letting routing decisions happen at the group level rather than per packet.

MPLS VPN and label stacking

MPLS supports stacking multiple labels rather than just one. MPLS VPN uses this to let a carrier separate multiple corporate customers' traffic over a single shared physical backbone, using labels to keep each customer's traffic from mixing with another's -- a widely used, cost-effective way to build private networks between a company's branch offices.

MPLS traffic engineering (MPLS-TE)

Ordinary IP routing tends to funnel traffic onto a single shortest path, but MPLS traffic engineering (TE) lets an administrator deliberately steer specific traffic onto a different, less congested path even if it isn't the shortest one. This helps large networks with multiple available paths, like a carrier's backbone, use their bandwidth more evenly.

How it relates to plain IP routing and SD-WAN

MPLS has long been the standard for enterprise leased lines because of its predictable paths and strong quality-of-service guarantees, but its dependence on carrier circuits makes it expensive to build and expand. That's driving a shift toward pairing MPLS with SD-WAN -- which intelligently combines multiple paths in software over ordinary internet connections -- or replacing some segments with SD-WAN outright in a hybrid setup.

What is inside the 32-bit label entry

An MPLS label entry is 32 bits long. It holds a 20-bit label value, a 3-bit field originally called experimental and now used for traffic class (QoS), a 1-bit bottom-of-stack flag that marks the last label in a stack, and an 8-bit time-to-live that works like the IP TTL. With 20 bits there are roughly a million possible label values, and some low values are reserved for special purposes.

How routers learn labels: LDP and RSVP-TE

Labels have to be agreed between neighboring routers. The Label Distribution Protocol (LDP) lets routers advertise labels for the destinations in their routing tables, building paths that follow the IP routing. RSVP-TE instead sets up explicitly engineered paths with reserved bandwidth, which is what traffic engineering uses. Segment routing is a newer approach that carries the path as a list of labels in the packet, so fewer routers need to hold per-path state.

Penultimate hop popping

The label is normally removed one router before the egress device, a practice called penultimate hop popping. The egress router then receives a plain IP packet and does not need to do both a label lookup and an IP lookup, which saves work at the edge.

VRFs and how MPLS VPNs keep customers apart

In an MPLS layer 3 VPN, each customer gets its own virtual routing table on the provider's edge routers, called a VRF. Routes are exchanged between edge routers using BGP, and a route distinguisher makes overlapping private addresses unique, so two customers can both use 10.0.0.0/8 without conflict. A two-label stack then carries traffic: an outer label to reach the far edge router and an inner label that selects the customer's VRF.

Layer 2 services over MPLS

MPLS can also carry Ethernet frames between sites as a virtual wire or a virtual LAN service, so two offices appear to share one Ethernet segment. This is useful when a customer wants to run its own routing between sites rather than rely on the provider's routing. Terms such as pseudowire, VPLS, and EVPN refer to ways of providing these services.

Where MPLS sits among the network layers

MPLS is sometimes called a layer 2.5 technology because its label sits between the link-layer header and the IP header. It does not replace IP; it adds a faster forwarding method underneath it, using routing protocols such as OSPF, IS-IS, or BGP to learn where destinations are. Knowing common network topologies, and how VLANs divide traffic inside a single site, helps place MPLS in context, since it usually connects separate sites over a provider's backbone.

How a label differs from an IP address

An IP address is meant to identify a destination uniquely, while an MPLS label only has meaning on one link between two neighboring routers; the same label value can mean something completely different on the next hop. Each router swaps the incoming label for the outgoing one as it forwards the packet, so a label is better thought of as a local shortcut than as an address.

Why enterprises are moving away from MPLS, and why many keep it

The attraction of MPLS has been predictable performance with service guarantees backed by the provider. The drawbacks are price per megabit, long provisioning times when a new branch needs a circuit, and dependence on one carrier's footprint. Broadband internet links are far cheaper, so many companies now use SD-WAN to combine them, sometimes with the MPLS circuit retained for voice or applications that cannot tolerate variation. Some organizations drop MPLS entirely at small branches while keeping it at data centers. The right balance depends on traffic sensitivity, the quality of local broadband, and contract terms. This page is general technical information, not a recommendation for any product.

Common misunderstandings

MPLS is not encryption: separation between customers comes from the provider's configuration, and traffic is not encrypted by default, so sensitive data may still warrant IPsec on top. MPLS is also not a type of internet access; the term describes a forwarding method inside a provider's network, and customers purchase it as a service. Finally, "MPLS" in marketing often means a private WAN service, which may run on technology other than classic MPLS.

Frequently Asked Questions

Does MPLS have anything to do with the internet connection I use at home?

Not directly. MPLS is mainly used inside a carrier's own backbone network, or in dedicated leased-line services that connect a company's multiple branch offices -- it's rarely something a home internet connection touches.

Isn't SD-WAN just going to replace MPLS entirely?

Not necessarily entirely -- many organizations run SD-WAN alongside MPLS rather than replacing it outright, keeping MPLS for latency-sensitive or mission-critical traffic while routing less critical traffic over cheaper internet-based SD-WAN paths. The mix depends on each organization's cost and reliability requirements.

Is MPLS faster than ordinary IP routing?

Label lookup is simpler than a longest-prefix IP lookup, which mattered more in earlier hardware. Today the main benefits are traffic engineering, fast reroute, and VPN services rather than raw lookup speed.

Does MPLS encrypt my traffic?

No. It isolates customer traffic by design but does not encrypt it. Organizations with confidentiality needs often add IPsec or other encryption on top.

What does LER versus LSR mean in practice?

A LER sits at the edge where traffic enters or leaves the MPLS cloud and pushes or pops labels. An LSR is a core router that swaps labels. A single router can play either role depending on where it sits for a given path.