Why VPWS service – MPLS has a two ethernet frame headers

First, I would recommend checking out Cisco's MPLS FAQ For Beginners, or the NANOG Presentation "MPLS for Dummies" by Richard A Steenbergen. They both have some really good information.

With that said, let me address your questions one at a time. (I have excerpted them in part below.)

1: After the initial convergence of the network, LSPs now exist between all FECs which are typically interfaces on LERs that connect to a subnet.

Yes, LSP's exist towards all reachable FECs. And an MPLS packet could now be switched across the network.

2: Assuming that baseline is correct; How does R1 know it is an LER for an LSP that spans to R6 for example

R1 has no clue that it is part of an LSP that spans to R6. It only cares about the local/connected labels and FECs. That is part of what makes MPLS Label Switching fast and effective. It doesn't have to know the whole path. The router just knows that to reach FEC1, I apply label 1234, and exit interface XYZ.

Then later hops in the path utilize the same process, swapping in the appropriate next hop label and switching the packet on.

As for the bottom line question How are the LERs determined?, a router itself doesn't really know or care if it's an LER. It just knows that when it receives a packet destined for a local destination, with no tag, it delivers it.

In your output above, you can see that the first 4 outgoing FECs have Pop tag listed as the Outgoing Tag. A packet leaving R1 for one of the local subnets on R2 or R3 simply has it's tag popped and forwarded out the appropriate interface.

When R2 or R3 receive that packet, they see no label and process it via the normal routing process which delivers it to a local interface.

To quote the Wikipedia article on MPLS:

At the egress router, when the last label has been popped, only the payload remains. This can be an IP packet, or any of a number of other kinds of payload packet. The egress router must therefore have routing information for the packet's payload, since it must forward it without the help of label lookup tables. An MPLS transit router has no such requirement.

How Routers Handle Limited and Directed Broadcasts

The first thing to understand to answer your questions is that limited broadcast frames are not routed. By default when a router receives a frame with a destination address that is broadcast at either layer 2 or layer 3, the router simply drops the frame. That's why routers are said to be the boundary of broadcast domains.

Some examples of these would be:

• ff-ff-ff-ff-ff-ff (layer 2 broadcast)
• 255.255.255.255 (layer 3 limited broadcast)

Thinking about it, this makes sense. If routers forwarded broadcasts a single arp request would reach every single reachable host on the internet which would be terribly inefficient and rather silly.

Directed broadcasts on the other hand are sometimes routed. (I.E. 192.168.1.255/24) Normally by default this functionality is disabled but can be enabled by issuing the ip directed-broadcast command on the router. This will allow it to forward directed broadcasts according to its routing table as if they were normal packets. This does not however allow the router to forward limited broadcasts, those are still blocked by default. This is also slightly off topic as to your original question, see this cisco forms page for more on this.

Layer 3 Broadcast But not Layer 2?

To answer your second question, it would make no sense to have a frame with a layer 3 broadcast address without a layer 2 broadcast address. This would defeat the entire purpose of it being a broadcast frame and just not work outright. Having a unicast layer 2 destination address would not change the router's behavior at all since the router makes its decisions at layer 3. All the router cares about is that 255.255.255.255 destination address and drops the packet.

Where this would matter is with switches which don't care about the layer 3 address at all. The switches would only see the unicast layer 2 address. Instead of sending the packet out all interfaces on the same vlan it would use the source address table (SAT) like it would with any other unicast destination address. In effect, by assigning a unicast layer 2 address the frame is no longer a broadcast frame at all even though it has the 255.255.255.255 address at layer 3.

How DHCP Relay Works in Practice

As for your last question, DHCP relay is a router's way of "cheating" around the rule about not forwarding broadcast packets. Let's look at a DHCP Discover packet:

• Source MAC: [unicast mac of the source]
• Dest MAC: ff-ff-ff-ff-ff-ff
• Source IP: 0.0.0.0
• Destination IP: 255.255.255.255
• Source Port: UDP 68
• Destination Port: UDP 67

When the router sees a packet arrive on an interface with the ip helper-address command configured it checks to see is it matches any of the protocols that are "helped" by default or configured with the global ip forward-protocol command. In this case because it's DHCP the router sees that the destination port matches UDP 67 and allows the packet to be "helped". The router then changes the destination IP address from 255.255.255.255 to the IP address configured by the ip helper-address command as well as changing the source address to the address of the router interface on which the packet arrived and passes the packet along to the rest of the routing logic.

Now that the packet has a unicast destination address the router treats it like any other packet. It arps for the destination IP address (which is now that helper address) and then replaces the layer 2 addresses before sending the packet out the appropriate interface.

Getting Back Again

The router uses essentially the same process in reverse for the DHCP offer that is sent back to the client. The DHCP servers sends the offer to the IP address that was specified as the source address on the DHCP Discover packet. So the packet leaving the DHCP server looks like:

• Source MAC: unicast mac of the DHCP server
• Dest MAC: mac address of the router or the DHCP server's default gateway
• Source IP: unicast IP address of the DHCP server
• Destination IP: ip address of the first router interface that the DHCP Discover packet reached
• Source Port: UDP 67
• Destination Port: UDP 68

Since this packet has a unicast layer 3 destination address routers will forward the packet normally until it reaches the router with an interface that has an IP address matching the destination IP of the packet. Remember from earlier that this router has the ip helper-address configuration on that interface still. The router checks if the packet is a DHCP Offer then rewrites the packet to become a broadcast packet and sends it back out that interface knowing that the DHCP client is somewhere on that network segment. The packet leaving the router now looks like this.

• Source MAC: unicast mac of the router interface
• Dest MAC: ff-ff-ff-ff-ff-ff
• Source IP: unicast IP address of the DHCP server
• Destination IP: 255.255.255.255
• Source Port: UDP 67
• Destination Port: UDP 68

TL:DR; DHCP relay using the ip helper-address interface subcommand "cheats" around the rule that routers cannot forward limited broadcasts by changing the packet's destination IP address to the unicast IP address of the DHCP server before routing it. This allows all routers down the line to route the packet appropriately to the DHCP server. When replying the DHCP server sends the packet back to the unicast IP address of the router interface that first received the DHCP Discover packet (the one with the ip helper-interface command). When the router receives the offer back it converts it back to a broadcast packet and sends it out the interface with the client in its broadcast domain.