[barcaroller <barcaroller@xxxxxxxxx>]

I have a pcap file where, in each packet, the header hierarchy is as follows:

ETH
� IP
� � GRE
� � � MPLS
� � � � ETH �<--- ?
� � � � � VLAN
� � � � � � IP
� � � � � � � TCP/UDP


I would not expect to see an Ethernet header right below an MPLS 
header.  And yet wireshark was able to properly identify/parse the 
headers, even though there's no indication in the MPLS header that the 
following header is Ethernet.  How did wireshark do that?