MPLS Explained: Labels, LSPs and Why Providers Still Use It

MPLS forwards packets by a short fixed-length label rather than by looking up a destination address. The label is decided once, at the edge, and every device after that makes a simple lookup in a much smaller table.

It is frequently called a layer 2.5 protocol, because the label sits between the layer 2 header and the layer 3 packet. That is a useful way to remember where it lives, though the real point is that MPLS is indifferent to what it carries.

How a Packet Moves

Two device roles:

• LER (Label Edge Router) sits at the boundary. The ingress LER classifies an incoming packet, decides its path, and pushes a label. The egress LER pops the label and forwards the packet normally.
• LSR (Label Switch Router) sits in the core. It reads the incoming label, swaps it for the outgoing one, and forwards. It never inspects the IP header.

The path a labelled packet follows is a Label Switched Path, and it is unidirectional — return traffic takes its own LSP, which may be a different route. Labels are distributed between routers by LDP, or by RSVP-TE where traffic engineering is required.

One optimization appears on exams: penultimate hop popping. The second-to-last router removes the label rather than leaving it for the egress LER, saving that router a redundant lookup.

What It Is Actually For

The original justification — label lookups are faster than IP lookups — stopped mattering years ago, once hardware forwarding made longest-prefix match cheap. MPLS survived for different reasons.

Traffic engineering. Ordinary IP routing sends everything down the shortest path and leaves other links idle. MPLS-TE lets an operator pin specific traffic to specific paths, balancing load and reserving capacity.

VPNs. This is the commercial core of MPLS. A provider stacks labels: an outer transport label moves the packet across the backbone, and an inner VPN label identifies which customer it belongs to. Customers can use overlapping private address space without conflict, because they are kept in separate routing tables — VRFs — on the provider edge router.

Any transport. The same mechanism carries Ethernet, frame relay or ATM, which is how providers consolidated legacy services onto one backbone.

Predictable performance. A provider can offer an SLA on latency and loss because it controls the path, which is what made MPLS the default for voice and other traffic sensitive to quality of service.

Security: Private Is Not Encrypted

This distinction is worth being blunt about, because it is widely misunderstood and it is exam material.

An MPLS VPN is private in the sense that traffic is separated from other customers by labels and routing tables. It is not encrypted. Anyone with access to the provider's infrastructure — the provider, or anyone who compromises it — can read the traffic.

Organizations with real confidentiality requirements run IPsec over the MPLS circuit, accepting the overhead. Treating the circuit as trusted because it is labelled "private WAN" is exactly the perimeter assumption that zero trust exists to remove.

MPLS Versus SD-WAN

The honest comparison: MPLS gives predictable performance and a real SLA, at high cost per megabit and with provisioning measured in weeks. SD-WAN uses ordinary internet circuits with encrypted overlays, costs far less, deploys in days, and steers traffic dynamically across multiple links — but inherits the internet's variability.

Most organizations now run both: MPLS for the traffic that genuinely needs guaranteed behavior, broadband for everything else, with SD-WAN deciding which is which. Cloud adoption pushed this along, since backhauling traffic to a data center over MPLS only to send it back out to the internet became difficult to justify.

Exam Focus

Know MPLS forwards on labels and sits between layers 2 and 3. Know LER pushes and pops while LSR swaps. Know the LSP is unidirectional. Know MPLS VPNs provide separation, not encryption. And when a scenario weighs cost against guaranteed performance across a WAN, recognize that as the MPLS versus SD-WAN question.