Quick Summary
- MPLS (Multiprotocol Label Switching) forwards packets using short labels instead of long IP addresses, making routing faster
- Labels are pushed at the network edge, swapped at each hop, and popped before delivery -- like shipping tags on a package
- ISPs use MPLS for traffic engineering, VPNs, and guaranteeing quality of service across their networks
The Package Delivery Analogy
Imagine you work at a shipping warehouse. Every day, thousands of packages arrive and need to be sent to the right destination. One approach is to read the full street address on every package and look it up in a massive directory to figure out which truck it should go on. That works, but it is slow -- especially when you are processing millions of packages per second.
MPLS takes a smarter approach. Instead of reading the full address at every stop along the way, the first warehouse reads the address once, then sticks a simple color-coded tag on the package. Every warehouse after that just looks at the tag -- "blue tag goes to truck 7" -- instead of reading the full address. The tag is much faster to process than a complete address lookup. At the final warehouse, the tag is removed and the package is delivered using its original address. That is exactly how MPLS works in networking.
MPLS stands for Multiprotocol Label Switching. The "multiprotocol" part means it can carry any type of traffic -- IPv4, IPv6, Ethernet frames, and more. The "label switching" part describes its core mechanism: instead of making a full routing table lookup at every router, MPLS routers use short, fixed-length labels to make forwarding decisions. This makes forwarding extremely fast and enables powerful traffic engineering capabilities that traditional IP routing cannot easily achieve.
How a Packet Travels Through an MPLS Network
Watch as a packet enters the MPLS cloud, gets labeled, swapped, and delivered:
Try It Yourself: MPLS Label Simulator
Click "Send Packet" to watch label operations in action. Toggle PHP mode to see penultimate hop popping.
The Three Label Operations
Everything MPLS does comes down to three simple operations on labels. Every router in the MPLS network performs exactly one of these:
PUSH -- Adding a Label at the Edge
When a packet enters the MPLS network, the ingress PE router (Provider Edge) examines the packet's destination IP address, looks it up in its routing table, and assigns an MPLS label. This label is inserted between the Layer 2 header (like Ethernet) and the Layer 3 header (IP). The label is just a 20-bit number -- much smaller and faster to process than a full IP address. The PE router "pushes" this label onto the packet, and from this point forward, the packet will be forwarded based on the label, not the IP address. Think of it as sticking a color-coded shipping tag on a package at the first warehouse.
SWAP -- Exchanging Labels in the Core
P routers (Provider core routers) in the middle of the MPLS network never look at the IP header. They only look at the MPLS label. When a P router receives a labeled packet, it looks up the incoming label in its label forwarding table (called the LFIB), replaces it with a new outgoing label, and sends the packet out the correct interface. This swap operation is incredibly fast because the router only needs to match a short number, not perform a longest-prefix match on a full IP address. The label changes at every hop, but the packet keeps moving toward the same destination. Each router along the path has already agreed (via a label distribution protocol like LDP or RSVP-TE) on what each label number means.
POP -- Removing the Label at the Exit
The egress PE router removes (pops) the MPLS label and forwards the packet as a normal IP packet to the customer's network. In practice, the penultimate (second-to-last) MPLS router often pops the label instead -- this optimization is called Penultimate Hop Popping (PHP). PHP saves the egress PE from having to do two lookups (one for the label, one for the IP). The egress PE receives a plain IP packet and simply routes it normally. The customer's router (CE) never sees any MPLS labels -- to the customer, it looks like normal IP routing.
PE vs P Routers: Understanding the Roles
MPLS networks have two types of routers with very different jobs. PE (Provider Edge) routers sit at the boundary between the customer's network and the service provider's MPLS network. They are the smart routers that understand both traditional IP routing and MPLS. PE routers look at IP addresses, assign labels, and manage customer-specific routing tables (called VRFs in MPLS VPN scenarios). They do the hard work.
P (Provider) routers are the core backbone routers. They only understand MPLS labels -- they never look at IP addresses in customer traffic. This makes them extremely fast and simple. A P router just looks at the incoming label, swaps it, and sends the packet out. Because P routers do not need to know about customer routes, they can handle enormous amounts of traffic without maintaining huge routing tables. This separation of concerns is one of MPLS's greatest design advantages.
CE (Customer Edge) routers sit on the customer's side. They connect to PE routers using standard protocols like OSPF, BGP, or static routes. CE routers know nothing about MPLS -- they just see a normal IP connection to their service provider. This transparency makes MPLS easy to deploy from the customer's perspective.
Why ISPs Use MPLS
MPLS is not just faster IP routing. It enables capabilities that traditional IP routing simply cannot provide:
Traffic Engineering
With traditional IP routing, traffic always takes the shortest path. This can leave some links overloaded while others sit idle. MPLS lets operators steer traffic along specific paths using RSVP-TE, balancing load across the network and avoiding congestion. This is critical for large ISP backbones.
MPLS VPNs (L3VPN)
MPLS VPNs let ISPs provide isolated, private networks to enterprise customers using a shared infrastructure. Each customer gets their own virtual routing table (VRF) on the PE routers. Customer traffic is separated by labels, so different customers can even use the same IP address ranges without conflict.
Quality of Service (QoS)
MPLS labels include a 3-bit "EXP" field (now called TC) for marking traffic priority. ISPs use this to guarantee bandwidth for voice and video traffic while letting bulk data use whatever capacity remains. This is why many enterprises pay for MPLS services -- guaranteed performance for critical applications.
MPLS VPN: Private Networks Over Shared Infrastructure
One of MPLS's most commercially important applications is the Layer 3 VPN (L3VPN). Here is how it works: an ISP has one physical network, but they want to provide private network services to hundreds of different enterprise customers. Without MPLS, they would need separate physical links or complex GRE tunnels for each customer. With MPLS VPN, the solution is elegant.
Each customer's routes are stored in a separate VRF (Virtual Routing and Forwarding) table on the PE router. When Customer A sends a packet, the PE router looks it up in Customer A's VRF, not the global routing table. The PE then pushes two labels onto the packet: an outer label for transport across the MPLS core, and an inner label that identifies which customer VRF the packet belongs to. P routers in the core only see the outer label and forward normally. The egress PE uses the inner label to figure out which customer should receive the packet.
This means two customers can both use the IP range 10.0.0.0/8 internally and their traffic will never mix. The MPLS labels keep everything separated. PE routers exchange customer routes using MP-BGP (Multiprotocol BGP) with Route Distinguishers and Route Targets, which is how the ingress PE knows which label to use for each customer's traffic.
Common MPLS Misconceptions
"MPLS Is Encrypted"
MPLS provides traffic isolation, not encryption. Customer traffic in an MPLS VPN is separated by labels, but the data itself is not encrypted. If you need encryption, you still need IPsec or another encryption layer on top of MPLS. Many people confuse "VPN" with "encrypted tunnel" -- MPLS VPNs are virtual and private in the routing sense, but not cryptographically secure.
"MPLS Is Obsolete Because of SD-WAN"
SD-WAN and MPLS solve different problems. SD-WAN provides application-aware routing and uses internet links, while MPLS provides guaranteed bandwidth and deterministic performance on the provider backbone. Many enterprises use both: MPLS for latency-sensitive traffic (voice, video) and SD-WAN for internet-bound and best-effort traffic.
"MPLS Is Only for Big ISPs"
While MPLS is most associated with ISP backbones, it is also widely used inside large enterprise data centers, by mobile carriers for LTE/5G backhaul, and increasingly in segment routing (SR-MPLS) for modern network automation. Any network that needs traffic engineering or VPN services can benefit from MPLS.
Learning MPLS Hands-On
MPLS has traditionally been difficult to learn hands-on because it requires specialized router hardware or complex virtual lab setups with heavyweight router images. natted.cloud lets you build MPLS topologies with PE and P routers in your browser, with no installation, no virtual machines and no license fees. You configure each router's label operations yourself: the LSPs an ingress router pushes a label for, and the swap or pop action for each incoming label on the routers along the path.
Our MPLS labs walk you through the fundamentals step by step: push, swap and pop, penultimate hop popping, several LSPs from one router, and what happens when a label is missing or mapped wrongly. A packet trace shows the actual label values on the packet at every hop, making the abstract concepts concrete and visual. Labels are configured statically: LDP and RSVP label distribution, VRFs and route targets are not modelled, so those parts of an MPLS VPN stay in the explanation above.
Frequently asked questions about MPLS
What does MPLS stand for?
MPLS stands for Multiprotocol Label Switching. It uses short fixed-length labels instead of long IP addresses for per-hop forwarding decisions, which is faster and enables traffic engineering and VPN services.
How does MPLS work?
An ingress PE router examines the destination IP, pushes an MPLS label, and forwards the packet into the core. Each P router along the path swaps the label based on its LFIB and forwards out the matching interface. The egress PE pops the label and delivers the original IP packet.
What is the difference between PE and P routers?
PE (Provider Edge) routers sit at the boundary and talk to customers; they push and pop labels and hold customer routes (often in VRFs). P (Provider) routers are core routers that only swap labels — they never look at customer IPs, which keeps them fast and small.
Is MPLS encrypted?
No. MPLS provides traffic separation via labels and VRFs, but the payload is not encrypted. Customers who need confidentiality run IPsec or another encryption layer on top of MPLS.
Is MPLS obsolete because of SD-WAN?
No. SD-WAN and MPLS solve different problems. SD-WAN gives application-aware routing across cheap internet links; MPLS gives deterministic latency and guaranteed bandwidth on a managed provider backbone. Many enterprises run both.
Try MPLS yourself
You just learned push, swap, pop and how PE/P routers split the work. Now build an MPLS topology, configure the label actions on each router, and trace a packet to see its label change hop by hop.
Launch the MPLS lab →