Port 646: LDP — The protocol that teaches routers what labels mean

Port 646 carries the Label Distribution Protocol (LDP), the control protocol that makes Multiprotocol Label Switching (MPLS) networks possible. Before any packet can be forwarded using labels, routers need to have a conversation: "When I send you a packet with label 100, where should it go?" That conversation happens on port 646.

What LDP Does

MPLS works by attaching labels to packets—short, fixed-length values that routers use to make forwarding decisions. Instead of looking up full IP addresses in routing tables at every hop, routers just swap labels and forward. It's faster. It's more flexible. But it requires every router to agree on what the labels mean.

LDP is how routers negotiate those meanings. It establishes control sessions between Label Switching Routers (LSRs) and exchanges label mapping information—binding network prefixes to locally assigned labels. The result is a Label Switched Path (LSP) through the network, built from agreed-upon label mappings.

How Port 646 Works

LDP uses both UDP and TCP on port 646:¹

• UDP 646: Discovery mechanism. Routers send LDP Hello messages to find neighboring LSRs and announce their presence.
• TCP 646: Session establishment. Once neighbors are discovered, they open a TCP connection on port 646 to negotiate session parameters and exchange label mappings.

The TCP session is where the real work happens. Routers exchange LDP Initialization messages (protocol version, label distribution method, timer values) and then continuously update each other with label mappings as the network changes.²

The History: From TDP to LDP

LDP didn't appear in a vacuum. It evolved from Cisco's proprietary Tag Distribution Protocol (TDP), which solved the same problem but only for Cisco equipment. The IETF took what worked and standardized it.³

The original LDP specification was published as RFC 3036 in January 2001, authored by Loa Andersson, Paul Doolan, Nancy Feldman, Andre Fredette, and Bob Thomas. It was later revised and updated as RFC 5036 in October 2007.⁴

MPLS itself, described in RFC 3031, introduced the concept of forwarding packets using labels instead of full routing lookups. LDP became the most widely deployed protocol for distributing those labels—the standard way to build the control plane for MPLS networks.⁵

Why This Matters

MPLS powers much of the Internet's backbone. Service providers use it for traffic engineering, VPNs, and fast reroute. Enterprise networks use it to build overlay networks and guarantee quality of service.

None of that works without LDP. Port 646 is where the agreements get made—where routers establish the shared understanding that makes label switching possible.

You can have the fastest forwarding hardware in the world, but if the routers don't agree on what label 100 means, the packet goes nowhere. That's what port 646 prevents.

Security Considerations

LDP sessions run over TCP and can be secured with MD5 authentication to prevent unauthorized routers from participating in label distribution. Without authentication, a malicious router could inject false label mappings and redirect traffic.

The protocol itself doesn't encrypt label mapping information—it assumes the underlying network is trusted. In environments where that assumption doesn't hold, LDP sessions should run over secured transport or within protected network segments.

Checking What's Listening

To see if LDP is running on your system:

# Linux/Unix - check if port 646 is listening
sudo netstat -tulpn | grep :646
sudo ss -tulpn | grep :646

# Check both TCP and UDP
sudo lsof -i :646

# Windows
netstat -an | findstr :646

If you see port 646 listening, you're likely running MPLS routing infrastructure. This isn't a port you'll find on typical workstations or servers—it's specific to routers and switches participating in MPLS networks.

Related Ports

• Port 639: MSDP (Multicast Source Discovery Protocol) - another routing control protocol
• Port 179: BGP (Border Gateway Protocol) - exterior routing protocol often used alongside MPLS
• Port 520: RIP (Routing Information Protocol) - older interior routing protocol