MPLS sits between L2 and L3 (“2.5”): forward by label, not longest-prefix. Ingress PE pushes, core P routers swap, egress pops. Labels are locally significant — each hop may use its own value for the same prefix.

• 32-bit header: 20-bit label, TC (QoS), bottom-of-stack, TTL. Groups of packets treated alike = FEC.
• Control plane: IGP + LDP (UDP discovery, TCP 646 sessions); data plane: CEF + LFIB (LIB holds all bindings).
• PHP: the penultimate router pops the transport label (implicit-null 3) — saves the egress one lookup.

MPLS Layer 3 VPN

CE routers know no MPLS. PE routers run VRF + MP-BGP (VPNv4); P routers only swap. A packet carries a two-label stack: transport (LDP) outside, VPN label (assigned by egress PE via MP-BGP) inside. RD makes overlapping prefixes unique; RT is the import/export policy.

mpls ip                       ! global
interface Gi0/0
 mpls ip
show mpls ldp neighbor
show mpls forwarding-table

The core never learns customer routes — that’s the scalability story in one sentence.