Troubleshooting an MPLS L3VPN shows traceroutes between CEs one hop shorter than expected; the penultimate LSR advertises implicit-null. Why does the traceroute omit the penultimate hop?

Penultimate Hop Popping (PHP) is a crucial MPLS optimization. When an LSR (Label Switch Router) advertises an implicit-null label (label 3), it signals to the upstream LSR that it should pop the top label before forwarding the packet. This means the penultimate LSR removes the MPLS label and forwards a pure IP packet to the egress PE router. Traceroute works by incrementing the Time-To-Live (TTL) field and observing ICMP Time Exceeded messages. Since the penultimate LSR has already popped the label and forwarded an IP packet, the traceroute effectively "sees" the egress PE as the next hop, making it appear as if one hop was skipped. Incorrect options: PE routers do not inherently suppress TTL replies or hide themselves from traceroute; their behavior is dictated by the MPLS forwarding process. Traceroute UDP probes are not specifically dropped by intermediate policy devices in a standard MPLS L3VPN setup to hide hops. MPLS L3VPN does not encrypt labels to hide intermediate hops; its security is based on VPN routing and forwarding (VRF) instances, not encryption of the label stack itself.