MPLS OAM (LSP ping and LSP traceroute)

An ordinary ping only tests the IP path. It pushes no label, so it succeeds even when the LSP is broken. The tool that tests the MPLS data plane is LSP ping (RFC 8029). This article explains how it works and observes the actual packets on an IOS XR (XRd) lab. Label distribution is covered in What is LDP.

Why an IP ping is not enough

When MPLS carries a packet, the ingress PE pushes a transport label. An IP ping sends without one, so it tests the IGP path and nothing else. Label forwarding can be broken and the IP ping still succeeds, with no sign of trouble in the routing table.

As the title of RFC 8029 says — “Detecting Multiprotocol Label Switched (MPLS) Data-Plane Failures” — what this mechanism targets is data-plane failures: the control plane (LDP) says the LSP exists while forwarding is broken.

How LSP ping works

LSP ping sends an MPLS echo request with the label of the LSP being tested. The receiver answers with an MPLS echo reply.

Element	Content
Destination address	127/8 (section 2.1), so that a packet escaping from a broken LSP is never IP forwarded onwards. The 16M addresses also let it spread probes across ECMP paths
Target FEC Stack	A TLV saying which FEC is being tested; the first element corresponds to the top of the label stack. For a prefix advertised by LDP it is sub-type 1
Reply Mode	How to answer. 2, reply via an IPv4/IPv6 UDP packet, is the default; 1 is do not reply, 3 adds a Router Alert, 4 uses an application-level control channel

The Target FEC Stack is the point. Forwarding purely on labels cannot reveal that a transit LSR confused this label with another FEC’s. Carrying “the traffic on this label should belong to this FEC” lets the receiver detect the mismatch.

Return codes

The reply carries a return code. Of those the RFC defines, three come up often.

Value	RFC 8029 definition	Observed in this lab?
3	Replying router is an egress for the FEC	Observed (every reply from a healthy LSP)
4	Replying router has no mapping for the FEC	Not observed
8	Label switched at stack-depth	Not observed

Only 0 (in the request itself) and 3 appeared in this article. 4 and 8 are listed as RFC definitions; this lab did not reproduce them. They appear when the replying router does not know the FEC, or when a transit LSR rather than the egress answers.

LSP traceroute

LSP traceroute sends with the label stack TTL increasing by one. The LSR where the TTL expires answers, so the state of each hop becomes visible. The replies carry the label used at that hop and the MRU (maximum receive unit).

An ordinary IP traceroute shows neither which labels the core LSRs use nor where PHP happens.

Lab topology

A chain with no redundancy. The core (PE1 - P1 - P2 - PE2) runs OSPF and LDP, and CE1 and CE2 attach to the PEs in VRF CUST-A and reach each other over VPNv4. LSP ping starts at PE1 and tests the FEC of PE2’s loopback (5.5.5.5/32).

The MPLS-OAM lab
  CE1 ------ PE1 ------ P1 ------ P2 ------ PE2 ------ CE2
(AS 65101)    |          ^                   |   (AS 65102)
           vrf CUST-A    |                vrf CUST-A
              +------ iBGP vpnv4 (Lo0) ------+
                         STEP 2 drops LDP here

Router	Lo0	Role	Label range
CE1	1.1.1.1	AS 65101, 192.168.1.0/24	-
PE1	2.2.2.2	Ingress/egress LSR. Where LSP ping starts	24000 - 24999
P1	3.3.3.3	Transit LSR (swap)	33000 - 33999
P2	4.4.4.4	Transit LSR (PHP)	44000 - 44999
PE2	5.5.5.5	Ingress/egress LSR. The FEC being tested	55000 - 55999
CE2	6.6.6.6	AS 65102, 192.168.2.0/24	-

The label ranges are split per router. LSP traceroute shows the label used at each hop, so this makes who allocated a label readable.

Overview of the verification

STEP	Operation	What it checks
0	Initial state (`mpls oam` disabled)	LSP ping is not available. IOS XR needs it enabled explicitly
1	Enable `mpls oam` on the four core routers	`ping mpls` and `traceroute mpls` succeed; the packets are examined in the capture
2	Drop LDP between PE1 and P1 with an ACL	LSP ping fails while IP reachability inside the core keeps working
3	Remove the ACL	It recovers
4	Add a static label on P1 to try to break only the forwarding	Configuration cannot create the mismatch
5	Remove everything (final state)	Back to the same state as STEP 0

STEP 0: not available by default on IOS XR

With nothing enabled, ping mpls ends without running.

STEP 0 PE1 ping mpls ipv4 5.5.5.5/32 (mpls oam disabled)
RP/0/RP0/CPU0:PE1#ping mpls ipv4 5.5.5.5/32
Mon Oct 12 03:37:56.859 UTC
% MPLS Embedded Management Subsystem is not running.
To enable, use 'mpls oam' global config command.

The subsystem that handles OAM is not running. Enabling it is one line, and it goes on all four core routers (the answering side needs it too).

Configuration committed on PE1 in STEP 1
mpls oam
!

STEP 1: testing a healthy LSP

Once enabled it works. With verbose, each reply shows its return code. The output always begins with the legend for the result characters, which is where to look when something fails.

STEP 1 PE1 ping mpls ipv4 5.5.5.5/32 repeat 2 verbose
RP/0/RP0/CPU0:PE1#ping mpls ipv4 5.5.5.5/32 repeat 2 verbose
Mon Oct 12 03:44:38.956 UTC

Sending 2, 100-byte MPLS Echos to 5.5.5.5/32,
      timeout is 2 seconds, send interval is 0 msec:

Codes: '!' - success, 'Q' - request not sent, '.' - timeout,
  'L' - labeled output interface, 'B' - unlabeled output interface,
  'D' - DS Map mismatch, 'F' - no FEC mapping, 'f' - FEC mismatch,
  'M' - malformed request, 'm' - unsupported tlvs, 'N' - no rx label,
  'P' - no rx intf label prot, 'p' - premature termination of LSP,
  'R' - transit router, 'I' - unknown upstream index,
  'X' - unknown return code, 'x' - return code 0

Type escape sequence to abort.

!      size 100, reply addr 10.4.5.5, return code 3
!      size 100, reply addr 10.4.5.5, return code 3

Success rate is 100 percent (2/2), round-trip min/avg/max = 14/15/16 ms

return code 3 is RFC 8029’s “replying router is an egress for the FEC”.

Traceroute shows the label at each hop

STEP 1 PE1 traceroute mpls ipv4 5.5.5.5/32
RP/0/RP0/CPU0:PE1#traceroute mpls ipv4 5.5.5.5/32
Mon Oct 12 03:44:39.229 UTC

Tracing MPLS Label Switched Path to 5.5.5.5/32, timeout is 2 seconds

Codes: '!' - success, 'Q' - request not sent, '.' - timeout,
  'L' - labeled output interface, 'B' - unlabeled output interface,
  'D' - DS Map mismatch, 'F' - no FEC mapping, 'f' - FEC mismatch,
  'M' - malformed request, 'm' - unsupported tlvs, 'N' - no rx label,
  'P' - no rx intf label prot, 'p' - premature termination of LSP,
  'R' - transit router, 'I' - unknown upstream index,
  'X' - unknown return code, 'x' - return code 0

Type escape sequence to abort.

  0 10.2.3.2 MRU 1500 [Labels: 33003 Exp: 0]
L 1 10.2.3.3 MRU 1500 [Labels: 44003 Exp: 0] 20 ms
L 2 10.3.4.4 MRU 1500 [Labels: implicit-null Exp: 0] 74 ms
! 3 10.4.5.5 80 ms

One line follows per hop: L is a hop that forwards with a label, ! is arrival.

The label values show who allocated them. The 33003 that PE1 pushes is from P1’s range (33000s), and the 44003 that P1 swaps to is from P2’s range (44000s). Hop 2 reads implicit-null because P2 performs PHP, which the traceroute output states directly. The MRU of each hop is visible too.

Inside the packets

The echo request PE1 sent:

STEP 1 No.856 MPLS echo request (PE1 to 127.0.0.1, tshark -V excerpt)
MultiProtocol Label Switching Header, Label: 33003, Exp: 0, S: 1, TTL: 255
    0000 1000 0000 1110 1011 .... .... .... = MPLS Label: 33003 (0x080eb)
    .... .... .... .... .... 000. .... .... = MPLS Experimental Bits: 0
    .... .... .... .... .... ...1 .... .... = MPLS Bottom Of Label Stack: 1
    .... .... .... .... .... .... 1111 1111 = MPLS TTL: 255
Internet Protocol Version 4, Src: 10.2.3.2, Dst: 127.0.0.1
    0100 .... = Version: 4
    .... 0110 = Header Length: 24 bytes (6)
    Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
        0000 00.. = Differentiated Services Codepoint: Default (0)
        .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
    Total Length: 96
    Identification: 0x0000 (0)
    010. .... = Flags: 0x2, Don't fragment
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    ...0 0000 0000 0000 = Fragment Offset: 0
    Time to Live: 1
        [Expert Info (Note/Sequence): "Time To Live" only 1]
            ["Time To Live" only 1]
            [Severity level: Note]
            [Group: Sequence]
    Protocol: UDP (17)
    Header Checksum: 0x5884 [validation disabled]
    [Header checksum status: Unverified]
    Source Address: 10.2.3.2
    Destination Address: 127.0.0.1
    Options: (4 bytes), Router Alert
        IP Option - Router Alert (4 bytes): Router shall examine packet (0)
            Type: 148
                1... .... = Copy on fragmentation: Yes
                .00. .... = Class: Control (0)
                ...1 0100 = Number: Router Alert (20)
            Length: 4
            Router Alert: Router shall examine packet (0)
    [Stream index: 24]
User Datagram Protocol, Src Port: 3503, Dst Port: 3503
    Source Port: 3503
    Destination Port: 3503
    Length: 72
    Checksum: 0xde86 [unverified]
    [Checksum Status: Unverified]
    [Stream index: 34]
    [Stream Packet Number: 1]
    [Timestamps]
        [Time since first frame: 0.000000000 seconds]
        [Time since previous frame: 0.000000000 seconds]
    UDP payload (64 bytes)
Multiprotocol Label Switching Echo
    Version: 1
    Global Flags: 0x0000
        0000 0000 0000 0... = Reserved: 0x0000
        .... .... .... ...0 = Validate FEC Stack: False
        .... .... .... ..0. = Respond only if TTL expired: False
        .... .... .... .0.. = Validate Reverse Path: False
    Message Type: MPLS Echo Request (1)
    Reply Mode: Reply via an IPv4/IPv6 UDP packet (2)
    Return Code: No return code (0)
    Return Subcode: 0
    Sender's Handle: 0x5aa0c883
    Sequence Number: 1
    Timestamp Sent: Oct 12, 2026 03:44:38.694377462 UTC
    Timestamp Received: Jan  1, 1970 00:00:00.000000000 UTC
    Vendor Private
        Type: Vendor Private (64512)
        Length: 12
        Vendor Id: ciscoSystems (9)
        Value: 0001000400000005
    Target FEC Stack
        Type: Target FEC Stack (1)
        Length: 12
        FEC Element 1: LDP IPv4 prefix
            Type: LDP IPv4 prefix (1)
            Length: 5
            IPv4 Prefix: 5.5.5.5
            Prefix Length: 32

Download the pcap of the packet in the tshark output above (No.856 echo request)

The destination is 127.0.0.1, both UDP ports are 3503, and it carries a label with TTL 255. The Target FEC Stack holds the FEC being tested (5.5.5.5/32). The return code is 0 because this is a request.

And the echo reply that came back:

STEP 1 No.857 MPLS echo reply (PE2 to PE1, tshark -V excerpt)
Internet Protocol Version 4, Src: 10.4.5.5, Dst: 10.2.3.2
    0100 .... = Version: 4
    .... 0101 = Header Length: 20 bytes (5)
    Differentiated Services Field: 0xc0 (DSCP: CS6, ECN: Not-ECT)
        1100 00.. = Differentiated Services Codepoint: Class Selector 6 (48)
        .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
    Total Length: 76
    Identification: 0x0000 (0)
    000. .... = Flags: 0x0
        0... .... = Reserved bit: Not set
        .0.. .... = Don't fragment: Not set
        ..0. .... = More fragments: Not set
    ...0 0000 0000 0000 = Fragment Offset: 0
    Time to Live: 253
    Protocol: UDP (17)
    Header Checksum: 0xa0d4 [validation disabled]
    [Header checksum status: Unverified]
    Source Address: 10.4.5.5
    Destination Address: 10.2.3.2
    [Stream index: 25]
User Datagram Protocol, Src Port: 3503, Dst Port: 3503
    Source Port: 3503
    Destination Port: 3503
    Length: 56
    Checksum: 0x2bfc [unverified]
    [Checksum Status: Unverified]
    [Stream index: 35]
    [Stream Packet Number: 1]
    [Timestamps]
        [Time since first frame: 0.000000000 seconds]
        [Time since previous frame: 0.000000000 seconds]
    UDP payload (48 bytes)
Multiprotocol Label Switching Echo
    Version: 1
    Global Flags: 0x0000
        0000 0000 0000 0... = Reserved: 0x0000
        .... .... .... ...0 = Validate FEC Stack: False
        .... .... .... ..0. = Respond only if TTL expired: False
        .... .... .... .0.. = Validate Reverse Path: False
    Message Type: MPLS Echo Reply (2)
    Reply Mode: Reply via an IPv4/IPv6 UDP packet (2)
    Return Code: Replying router is an egress for the FEC at stack depth RSC (3)

Download the pcap of the packet in the tshark output above (No.857 echo reply)

It carries no label: the reply comes back over IP (reply mode 2). The return code is 3.

STEP 2: what a broken LSP looks like

An ACL drops only LDP (UDP 646 and TCP 646) between PE1 and P1. OSPF and IP forwarding stay, so the only thing that breaks is label distribution.

Configuration committed on PE1 in STEP 2
ipv4 access-list BLOCK-LDP
 10 deny udp any any eq ldp
 20 deny tcp any any eq ldp
 30 deny tcp any eq ldp any
 40 permit ipv4 any any
!
interface GigabitEthernet0/0/0/1
 ipv4 access-group BLOCK-LDP ingress
!

Without labels being distributed, the outgoing labels disappear from the forwarding table. In STEP 1 they were there.

STEP 1 PE1 show mpls forwarding
RP/0/RP0/CPU0:PE1#show mpls forwarding
Mon Oct 12 03:41:40.838 UTC
Local  Outgoing    Prefix             Outgoing     Next Hop        Bytes
Label  Label       or ID              Interface                    Switched
------ ----------- ------------------ ------------ --------------- ------------
24000  Pop         3.3.3.3/32         Gi0/0/0/1    10.2.3.3        168
24001  Pop         10.3.4.0/24        Gi0/0/0/1    10.2.3.3        0
24002  33001       4.4.4.4/32         Gi0/0/0/1    10.2.3.3        5644
24003  33002       10.4.5.0/24        Gi0/0/0/1    10.2.3.3        0
24004  33003       5.5.5.5/32         Gi0/0/0/1    10.2.3.3        23858
24005  Unlabelled  192.168.1.0/24[V]  Gi0/0/0/0    10.1.2.1        12400

With the ACL in place, every one of those entries becomes Unlabelled.

STEP 2 PE1 show mpls forwarding
RP/0/RP0/CPU0:PE1#show mpls forwarding
Mon Oct 12 03:49:49.500 UTC
Local  Outgoing    Prefix             Outgoing     Next Hop        Bytes
Label  Label       or ID              Interface                    Switched
------ ----------- ------------------ ------------ --------------- ------------
24000  Unlabelled  3.3.3.3/32         Gi0/0/0/1    10.2.3.3        2494
24001  Unlabelled  10.3.4.0/24        Gi0/0/0/1    10.2.3.3        0
24002  Unlabelled  4.4.4.4/32         Gi0/0/0/1    10.2.3.3        5644
24003  Unlabelled  10.4.5.0/24        Gi0/0/0/1    10.2.3.3        0
24004  Unlabelled  5.5.5.5/32         Gi0/0/0/1    10.2.3.3        11701
24005  Unlabelled  192.168.1.0/24[V]  Gi0/0/0/0    10.1.2.1        5100

LSP ping fails. Q means the request could not be sent, because there is no label to push.

STEP 2 PE1 ping mpls ipv4 5.5.5.5/32 repeat 2 verbose (legend omitted)
RP/0/RP0/CPU0:PE1#ping mpls ipv4 5.5.5.5/32 repeat 2 verbose
Mon Oct 12 03:52:51.405 UTC
Type escape sequence to abort.

Q      size 100, Unable to send echo request packet
Q      size 100, Unable to send echo request packet

Success rate is 0 percent (0/2)

Traceroute stops at the first hop too. [No Label] says there is no label to push.

STEP 2 PE1 traceroute mpls ipv4 5.5.5.5/32 (legend omitted)
RP/0/RP0/CPU0:PE1#traceroute mpls ipv4 5.5.5.5/32
Mon Oct 12 03:52:51.595 UTC
Type escape sequence to abort.

  0 0.0.0.0 MRU 0 [No Label]
Q 1 *

An IP ping cannot see it

In the same STEP, the VPN traffic from CE1 to CE2 is down.

STEP 2 CE1 ping 192.168.2.1 (the VPN traffic)
RP/0/RP0/CPU0:CE1#ping 192.168.2.1 source 192.168.1.1 count 50 timeout 1
Mon Oct 12 03:47:05.328 UTC
Type escape sequence to abort.
Sending 50, 100-byte ICMP Echos to 192.168.2.1 timeout is 1 seconds:
..................................................
Success rate is 0 percent (0/50)

Yet IP reachability inside the core is lossless.

STEP 2 PE1 ping 5.5.5.5 (IP reachability inside the core)
RP/0/RP0/CPU0:PE1#ping 5.5.5.5 source 2.2.2.2 count 50 timeout 1
Mon Oct 12 03:48:01.798 UTC
Type escape sequence to abort.
Sending 50, 100-byte ICMP Echos to 5.5.5.5 timeout is 1 seconds:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Success rate is 100 percent (50/50), round-trip min/avg/max = 10/12/32 ms

This is the reason the mechanism exists. The IGP is healthy, so IP works and the routing table looks normal. What is down is only the traffic carried over MPLS, and no amount of IP ping will find it. LSP ping reports immediately, as Q, that there is no label to push.

STEP	CE1 to CE2 (VPN)	PE1 to PE2 (core IP)	LSP ping
0	100% (50/50)	100% (50/50)	not available
1	100% (50/50)	100% (50/50)	100% (5/5)
2	0% (0/50)	100% (50/50)	0% (0/5)
3	100% (50/50)	100% (50/50)	100% (5/5)
4	100% (50/50)	100% (50/50)	100% (5/5)
5	100% (50/50)	100% (50/50)	not available

STEP 4: configuration cannot split the control and data planes

What LSP ping targets is “the control plane is fine but forwarding is broken”. Can that be created from configuration? A static label is added on P1 to disagree with the one LDP distributed.

Configuration committed on P1 in STEP 4
mpls static
 address-family ipv4 unicast
  local-label 33500 allocate per-prefix 5.5.5.5/32
   forward
    path 1 nexthop GigabitEthernet0/0/0/1 10.3.4.4 out-label 44999
   !
  !
 !
!

The commit succeeds, but it is never installed.

STEP 4 P1 show mpls static local-label all
RP/0/RP0/CPU0:P1#show mpls static local-label all
Mon Oct 12 04:05:51.899 UTC
Label   VRF             Type         Prefix           RW Configured   Status
------- --------------- ------------ ---------------- --------------- --------
33500   default         Per-Prefix   5.5.5.5/32       Yes             Discrepancy

Discrepancy means LDP already holds a label for that FEC and the static one disagrees with it. The forwarding table still carries LDP’s label.

STEP 4 P1 show mpls forwarding
RP/0/RP0/CPU0:P1#show mpls forwarding
Mon Oct 12 04:05:51.627 UTC
Local  Outgoing    Prefix             Outgoing     Next Hop        Bytes
Label  Label       or ID              Interface                    Switched
------ ----------- ------------------ ------------ --------------- ------------
33000  Pop         2.2.2.2/32         Gi0/0/0/0    10.2.3.2        30693
33001  Pop         4.4.4.4/32         Gi0/0/0/1    10.3.4.4        6154
33002  Pop         10.4.5.0/24        Gi0/0/0/1    10.3.4.4        560
33003  44003       5.5.5.5/32         Gi0/0/0/1    10.3.4.4        31263

Configuration cannot make the control and data planes disagree. The failures LSP ping looks for come from outside the configuration: software defects, hardware faults. Reproducing one in a lab means breaking the control plane instead, as STEP 2 does.

STEP 5: removal

With mpls oam removed, the state is the same as STEP 0 again.

STEP 5 PE1 ping mpls ipv4 5.5.5.5/32 (after removal)
RP/0/RP0/CPU0:PE1#ping mpls ipv4 5.5.5.5/32
Mon Oct 12 04:12:53.319 UTC
% MPLS Embedded Management Subsystem is not running.
To enable, use 'mpls oam' global config command.

The running-config of the final STEP is identical to STEP 0 on all six routers, compared down to the number of occurrences of each line in the collected data.

Design notes

mpls oam is needed on the answering side too. Enabling it only at the source leaves the transit and egress LSRs unable to reply
LSP ping also finds control-plane failures. With no labels distributed, as in STEP 2, it stops with Q before even sending a request. It is not only a data-plane tool
Traceroute tells you more. The label and MRU of each hop, and where PHP happens, make it the first thing to reach for when isolating a fault
An IP ping succeeding is no guarantee that MPLS works, and the reverse holds too: an LSP ping failure does not mean the IP path is broken

Verification configs and show output

For every STEP, the following kinds of output were collected from all six routers, one file per router. The verification config is the ..._run.txt (the final state is the one from the last STEP).

File	Content
`..._clear.txt`	The record of the counters cleared in that STEP (`clear counters interface` and `clear mpls forwarding counters`)
`..._ping.txt`	The `ping` (50 packets, 1-second timeout) and `traceroute` of that STEP
`..._oam.txt`	The LSP ping and LSP traceroute record. These are operations, so they are kept apart from the show set. In the STEPs where `mpls oam` is disabled, the “not available” output is in here as it stands
`..._show.txt`	`show version`, `show interface description`, the OSPF, LDP and MPLS forwarding set, and so on
`..._log.txt`	`show logging` narrowed to that STEP
`..._run.txt`	`show running-config` at that point in time, that is the verification config of that STEP
`..._trace.txt`	`show mpls ldp trace` and `show mpls lsd trace` (four core routers only)
`..._commit.cfg`	Only the configuration actually committed in that STEP, for the routers that were changed

STEP 0: Initial state (mpls oam disabled)

Router	clear	ping	LSP ping	show	syslog	running-config	trace
CE1	clear	ping	—	show	log	run	—
PE1	clear	ping	oam	show	log	run	trace
P1	clear	ping	oam	show	log	run	trace
P2	clear	ping	oam	show	log	run	trace
PE2	clear	ping	oam	show	log	run	trace
CE2	clear	ping	—	show	log	run	—

STEP 1: Enable mpls oam on the four core routers

Router	clear	ping	LSP ping	show	syslog	running-config	trace	config committed
CE1	clear	ping	—	show	log	run	—	—
PE1	clear	ping	oam	show	log	run	trace	commit
P1	clear	ping	oam	show	log	run	trace	commit
P2	clear	ping	oam	show	log	run	trace	commit
PE2	clear	ping	oam	show	log	run	trace	commit
CE2	clear	ping	—	show	log	run	—	—

STEP 2: Drop LDP between PE1 and P1 with an ACL

Router	clear	ping	LSP ping	show	syslog	running-config	trace	config committed
CE1	clear	ping	—	show	log	run	—	—
PE1	clear	ping	oam	show	log	run	trace	commit
P1	clear	ping	oam	show	log	run	trace	—
P2	clear	ping	oam	show	log	run	trace	—
PE2	clear	ping	oam	show	log	run	trace	—
CE2	clear	ping	—	show	log	run	—	—

STEP 3: Remove the ACL

Router	clear	ping	LSP ping	show	syslog	running-config	trace	config committed
CE1	clear	ping	—	show	log	run	—	—
PE1	clear	ping	oam	show	log	run	trace	commit
P1	clear	ping	oam	show	log	run	trace	—
P2	clear	ping	oam	show	log	run	trace	—
PE2	clear	ping	oam	show	log	run	trace	—
CE2	clear	ping	—	show	log	run	—	—

STEP 4: Add a static label on P1 to try to break only the forwarding

Router	clear	ping	LSP ping	show	syslog	running-config	trace	config committed
CE1	clear	ping	—	show	log	run	—	—
PE1	clear	ping	oam	show	log	run	trace	—
P1	clear	ping	oam	show	log	run	trace	commit
P2	clear	ping	oam	show	log	run	trace	—
PE2	clear	ping	oam	show	log	run	trace	—
CE2	clear	ping	—	show	log	run	—	—

STEP 5: Remove everything (final state)

Router	clear	ping	LSP ping	show	syslog	running-config	trace	config committed
CE1	clear	ping	—	show	log	run	—	—
PE1	clear	ping	oam	show	log	run	trace	commit
P1	clear	ping	oam	show	log	run	trace	commit
P2	clear	ping	oam	show	log	run	trace	commit
PE2	clear	ping	oam	show	log	run	trace	commit
CE2	clear	ping	—	show	log	run	—	—

Packet captures were taken per STEP on two links.

STEP	PE1 - P1	P1 - P2
0	pcap	pcap
1	pcap	pcap
2	pcap	pcap
3	pcap	pcap
4	pcap	pcap
5	pcap	pcap

References

Source	What was referenced
RFC 8029 Detecting Multiprotocol Label Switched (MPLS) Data-Plane Failures	Section 2.1 (why 127/8, and its 16M addresses for ECMP), 3 (packet format, the reply mode and return code values), 3.2 (Target FEC Stack)
IOS XR MPLS Configuration Guide	Syntax of `mpls oam`, `ping mpls ipv4`, `traceroute mpls ipv4` and `mpls static`

The verification was carried out on XRd 26.1.1 (Cisco Modeling Labs).