MPLS (Multiprotocol Label Switching) is a networking technique that routes traffic using short labels rather than long IP address lookups. By attaching a small label to each packet at the network edge and forwarding based on that label through the core, MPLS enables fast, predictable, and traffic-engineered paths across large networks.
TL;DR — In traditional IP routing, every router reads the destination IP address and looks it up in a routing table. MPLS replaces this with label switching: the first router (Label Edge Router) assigns a short numeric label to the packet and pushes it onto the label stack. Intermediate routers (Label Switch Routers) forward the packet based only on the label — a faster operation than an IP lookup. The last router pops the label and delivers the packet using normal IP routing. MPLS is used by ISPs and enterprises for VPNs, traffic engineering, and guaranteed QoS over shared infrastructure.
Why MPLS was developed
Traditional IP routing makes an independent forwarding decision at every router based on the destination IP address. In the mid-1990s, this was computationally expensive — router hardware was far slower than today. MPLS was designed to speed up the forwarding path by replacing variable-length IP lookups with fixed-length label lookups.
While hardware advances (ASIC-based routers) solved the speed problem, MPLS remained valuable for three other capabilities it uniquely enables:
- Traffic engineering — controlling exactly which path traffic takes through the network, not just the best-metric path
- Layer 3 VPNs — carrying multiple customers’ traffic over a shared infrastructure with full isolation
- QoS guarantees — reserving bandwidth and prioritizing traffic types end-to-end across a network
How MPLS works
The MPLS label
An MPLS label is a 32-bit field inserted between the Layer 2 header (Ethernet) and the Layer 3 header (IP). It is called a “shim header.”
| Field | Size | Purpose |
|---|---|---|
| Label | 20 bits | Label value (0–1,048,575) |
| TC (Traffic Class) | 3 bits | QoS / Explicit Congestion Notification |
| S (Bottom of Stack) | 1 bit | 1 if this is the last label in the stack |
| TTL | 8 bits | Time to Live (decremented at each hop) |
Multiple labels can be stacked — the innermost label (S=1) is the final label. This enables MPLS VPNs where an outer label identifies the LSP and an inner label identifies the VPN customer.
Label operations
| Operation | Description | Where it happens |
|---|---|---|
| Push | Add a label to the packet | Ingress LER (entering MPLS domain) |
| Swap | Replace current label with a new one | LSR (intermediate router) |
| Pop | Remove the label from the packet | Egress LER (leaving MPLS domain) |
Label Switch Path (LSP)
An LSP is a predetermined, unidirectional path through the MPLS network from ingress to egress. Every packet carrying a given label follows the same LSP — unlike IP routing where different packets to the same destination can take different paths.
LSPs are established by two main protocols:
- LDP (Label Distribution Protocol) — distributes labels that follow the same path as the underlying IGP (OSPF or IS-IS)
- RSVP-TE (Resource Reservation Protocol - Traffic Engineering) — establishes explicitly routed LSPs with bandwidth reservations
MPLS network components
Label Edge Router (LER)
An LER sits at the boundary of the MPLS domain. It has two roles:
- Ingress LER — receives an IP packet, classifies it (based on destination IP, DSCP, or other criteria), assigns a label, and pushes it onto the packet
- Egress LER — receives a labeled packet, pops the label, and delivers the original IP packet to its destination
Label Switch Router (LSR)
An LSR is a core router within the MPLS domain. It receives labeled packets, looks up the label in its Label Forwarding Information Base (LFIB), swaps the incoming label for an outgoing label, and forwards the packet to the next hop — all without examining the IP header.
Label lookups in the LFIB are faster than IP longest-prefix-match lookups because labels are fixed-length integers rather than variable-prefix IP addresses.
MPLS use cases
MPLS VPNs (L3VPN)
MPLS Layer 3 VPNs allow service providers to offer private WAN services to multiple enterprise customers over shared infrastructure, with complete routing isolation between customers.
The architecture uses:
- PE routers (Provider Edge) — LERs at the customer boundary; maintain per-customer VRF (Virtual Routing and Forwarding) routing tables
- P routers (Provider core) — LSRs that forward packets using labels only; never see customer IP addresses
- CE routers (Customer Edge) — customer routers that connect to PE routers via BGP, OSPF, or static routing
A two-label stack is used: the outer label routes to the correct egress PE; the inner label (VPN label) identifies the customer VRF on the egress PE.
Traffic Engineering (MPLS-TE)
MPLS-TE allows network operators to route traffic along specific paths rather than the default shortest-path routes. This is used to:
- Load-balance traffic across multiple paths that IGP would treat as equal
- Route high-priority traffic on low-latency paths regardless of metric
- Reserve bandwidth for guaranteed SLAs
- Avoid specific links or nodes
RSVP-TE is used to signal and reserve resources along the explicit path.
QoS over MPLS
The TC (Traffic Class) field in the MPLS label carries QoS markings (similar to IP DSCP). Traffic can be prioritized end-to-end through the MPLS core based on these markings, enabling consistent latency and bandwidth guarantees for voice, video, and critical business applications.
MPLS vs SD-WAN
SD-WAN (Software-Defined Wide Area Network) emerged as a lower-cost alternative to MPLS-based enterprise WANs. The comparison is relevant for any organization managing multiple sites.
| Feature | MPLS | SD-WAN |
|---|---|---|
| Cost | High (dedicated, private infrastructure) | Low (runs over internet, broadband, 4G/5G) |
| Reliability | Very high (guaranteed SLAs) | Varies (depends on underlying connections) |
| Latency | Predictable, low | Variable (internet-dependent) |
| Traffic engineering | Explicit, deterministic | Policy-based, dynamic link selection |
| Setup time | Weeks to months | Days |
| Flexibility | Limited (ISP-managed) | High (software-configured) |
| Security | Private (isolated from internet) | Encrypted overlay on public internet |
| Cloud connectivity | Requires backhauling to MPLS PoPs | Direct internet breakout per site |
Many enterprises use hybrid approaches: MPLS for critical site-to-site traffic with guaranteed SLAs, SD-WAN over broadband for internet access and cloud connectivity.
MPLS in the modern network
MPLS remains the dominant technology in ISP cores and large enterprise WANs where predictable performance and traffic engineering are required. Within data centers, technologies like Segment Routing (SR-MPLS) are extending label-switching principles with simpler control planes. In cloud and SDN environments, overlay networks (VXLAN, GENEVE) achieve similar traffic isolation goals using different mechanisms.
Frequently asked questions
What is MPLS? MPLS (Multiprotocol Label Switching) is a technique that forwards network packets using short numeric labels rather than IP address lookups. Labels are assigned at the network edge and packets are switched through the core based only on the label, enabling faster forwarding, predetermined traffic paths, and VPN isolation over shared infrastructure.
How does MPLS differ from regular IP routing? In IP routing, every router reads the destination IP address and performs a longest-prefix-match lookup in its routing table. In MPLS, only the edge router (LER) performs this IP lookup — it assigns a label. Core routers (LSRs) forward packets based solely on the fixed-length label, which is faster than repeated IP lookups at every hop.
What is an LSP? An LSP (Label Switch Path) is a predetermined, unidirectional path through an MPLS network from an ingress Label Edge Router to an egress Label Edge Router. All packets with a given label follow the same LSP. LSPs can be established dynamically by LDP (following IGP paths) or explicitly by RSVP-TE (for traffic engineering).
What is an MPLS VPN? An MPLS VPN (specifically L3VPN) is a service that uses MPLS to carry multiple customers’ routing over shared provider infrastructure with complete isolation. Each customer has its own VRF (Virtual Routing and Forwarding) table on the edge router. Traffic is encapsulated with two labels — one to route through the MPLS core, one to identify the customer VRF at the egress.
Is MPLS being replaced by SD-WAN? SD-WAN has replaced MPLS for many enterprise edge use cases, particularly for internet access and cloud connectivity, because it is significantly cheaper and more flexible. MPLS remains preferred for applications requiring guaranteed latency and bandwidth SLAs, and ISP backbone infrastructure. Many enterprises use both: MPLS for critical inter-site traffic, SD-WAN for internet and cloud access.
What is traffic engineering in MPLS? MPLS traffic engineering (MPLS-TE) allows operators to route specific traffic flows along explicitly defined paths through the network, rather than the default shortest-path. RSVP-TE signals the path and reserves bandwidth along it. This enables load balancing across parallel paths, guaranteed bandwidth for high-priority traffic, and avoidance of specific links.
What is the MPLS label stack? MPLS supports stacking multiple labels on a single packet. The S (Bottom of Stack) bit in each label indicates whether it is the last label. In MPLS VPNs, two labels are typically used: an outer transport label that routes through the provider core, and an inner VPN label that identifies the customer and VRF at the egress PE router.