We have probes running on our links between our P-Node and PE routers. These probes are supposed to be picking up the different VRFs. I may be incorrect, but with MPLS, tagging of packets take place at every hop to identify the VRF it belongs to; and then decapsulation takes place? To my knowledge, when decoding the packets; i have come across that the probe looks at the inner most label (source label) and builds a table of all labels transversing the network (insane!). The problem with this is that labels are dynamically and randomly assigned by routers.
Anyway, the probe does seem to pick up the different VRFs but seem to have a problem picking up VRFs relating to traffic encapsulated by GTP.
The amount of traffic on the link is disproportional to the amount being captured/monitored in the different VRFs.
Could it be a label problem? Are labels assigned to the header of a gtp packet or within?
Not looking for possible solutions; just ideas...