MPLS-in-UDP: Entropy for the Underlay, Rules for the Domain

Two providers describe the same service label, and only one of them mentions a UDP header. The difference is not cosmetic: putting MPLS inside UDP changes what the outer IP network can see, and therefore what it can hash across parallel links. It also changes who is allowed to deploy it.

The layering is short enough to memorise: outer IP, then UDP, then the MPLS label stack, then the service payload. The label stack does not disappear; it still decides forwarding at the endpoint that resumes label switching.

What the UDP envelope adds

RFC 7510 defines this encapsulation with UDP destination port 6635 and uses the source-port field to carry flow entropy. An encapsulating device decides what counts as a flow and how to derive the value; the standard deliberately does not mandate one hash. That leaves room for vendor behaviour, and it means two implementations can produce different distributions for the same traffic mix. Read the value as a hint offered to the underlay, not as a routing decision made by the standard.

The benefit is indirect. A transit network that load-balances on an outer five-tuple now has something to hash, where a bare MPLS packet might have offered only the top label. Whether that helps depends on the platform doing the balancing and on which fields it actually considers.

Entropy is not bandwidth

Distributing flows more evenly across available links is not the same as combining them into one faster path. A single application flow still travels one path, and per-flow balancing cannot exceed the capacity of the link it lands on. The mechanism also does not guarantee even distribution; it only gives a hash function better inputs.

Keep the envelope stable for a given flow unless reordering is acceptable. If the source port changes per packet, the underlay will happily spread one conversation across several paths and reassembly becomes the application's problem. Consistent entropy per flow is the goal, not constant novelty.

The deployment boundary is part of the specification

RFC 7510 restricts deployment to a single operator's network or to an adjacent set of cooperating operators, with traffic managed so congestion is avoided. It also calls for filtering that prevents encapsulated traffic from escaping that domain. Those are not decorative conditions; they follow from the fact that the encapsulation adds no security of its own. Treat them as prerequisites for a legitimate deployment rather than as suggestions in a design note.

Nothing in the UDP header authenticates the sender, and nothing in it provides confidentiality or integrity for the payload. If the traffic needs protection, that comes from a separate mechanism with its own key management. Choosing MPLS-in-UDP does not upgrade the trust model.

Watch what protection does to the hashing you wanted

Add IPsec or another security encapsulation and the outer header that transit devices hash may change shape entirely. Tunnel mode can hide the inner UDP source port behind a new outer header, which means the entropy you carefully provided may not be visible where balancing happens. Encrypting first and encapsulating second is a different design from the reverse order, and the difference shows up as a link that carries far more traffic than its neighbours.

Evaluate the complete packet as it appears on the wire, not just the layer the standard describes. That is also the point to reconsider MTU and endpoint capacity, because a UDP header plus any security overhead reduces the payload that fits.

Decide with the whole path in view

Compare MPLS-in-UDP with alternatives such as GRE on the criteria that matter for your network: which fields the underlay balances on, how much overhead you can afford, what security wrap is required, and whether the domain boundary can be enforced. Assigning it an unconditional performance advantage over GRE is a conclusion the standards do not support.

Then test with real traffic mixes and check link utilisation per member, because a hash that looks good in a lab can collapse onto one link when every flow shares a tuple. The honest summary is that the encapsulation exposes information the underlay can use, inside a domain that has agreed to manage it.