What Is the Function of Penultimate Hop Popping (PHP)?

Why the Answer Is Correct

In an MPLS L3VPN path such as CE1-PE1-P1-P2-PE2-CE2, the egress PE2 advertises the implicit-null label through LDP, telling its upstream neighbor P2 to pop the transport (LDP/IGP) label. P2 is the last P router in the path and is by definition the penultimate LSR relative to the egress PE, which is exactly what option A describes: the last P router pops the transport label before forwarding toward the PE. The packet that arrives at PE2 still carries the VPN label, so PE2 performs a single LFIB lookup to identify the VRF and forward toward the CE. This is the operational purpose of PHP: it removes one label lookup from the egress PE and saves processing on the edge router.

Why the Other Options Are Wrong

Option C inverts the roles by saying the transport label is popped at the egress LSR, which is the behavior you get when PHP is disabled (explicit-null), not PHP. Option B is simply a description of ordinary forwarding at the egress PE — the PE does remove the VPN label before sending unlabeled frames to the CE — but that is not what penultimate hop popping does, and mislabeling it as the function of PHP makes it incorrect. Option D claims the second-to-last P router pops the VPN label, which is wrong on two counts: PHP always targets the outer transport label, and the VPN label is only swapped or removed by the egress PE2, never by a P router. Only A names the right router (the last P router) and the right label (the transport label).

Community Comment Notes

As vallzo puts it, PHP means the PE receives a packet without the LDP label, so it "doesn't have to do an extra lookup in the LFIB" before forwarding toward a non-MPLS CE — a clean statement of the efficiency rationale. dapardo adds the mechanics, noting that in frame-based MPLS the last P router pops the LDP label because the egress PE requested it through LDP, so the PE gets a packet carrying only the VPN label. Sammy3637 voted C, but interestingly his own explanation describes the penultimate router removing the transport label — evidence of how the wording trips people up, since his stated mechanism actually matches A. d740f62 simply marked A as correct, consistent with the 80-to-20 vote split in favor of the suggested answer.