Does not handle 802.1Q tagged frames correctly

The system I'm using to report the bug was an upgrade, but I've also tested on a virgin install of 12.04, and the same issues are still present.

can you please try again with 14.04? 12.04 has a slightly outdated pcap version... thanks!

Still there. Seems to be an issue with the 3.x kernels. Bug does not exhibit in 2.6.x kernels

Using tcpdump, you can clearly see the differences

I've got the same bug.
Additional information:
If I use the "vlan" tag in the capture filter I only see frames with stacked vlans.
If I use "vlan 1" I will only see frames with vöan 1 as the inner tag.
More:
The vlan information in the frame I capture is at location ether[14,2].
If I filter on that location the frames are filtered at [18,2] although I did not
have any "vlan" in the capture filter string.
It seems that there is in implicit vlan tag in the capture filter. that produces an offset
within the frame if a (n outer) vlan is present!

What happens if you build a shiny new version of libpcap from the GitHub repository:

    https://github.com/the-tcpdump-group/libpcap/

and then build a shiny new version of tcpdump:

    https://github.com/the-tcpdump-group/tcpdump

with it?

Hello!
I've installed kernel 2.6.38-16-generic and still have the same error.
So is it really an issue with the kernel?

If it IS an issue with the kernel building a new version of libpcap and tcpdump will not help.

So I might have to set up a System with 10.04 to verify...

> If it IS an issue with the kernel building a new version of libpcap and tcpdump will not help.

If it's an issue with the kernel changing the way it handles VLAN tags - i.e., whether it leaves them in the packet data, so that the filter code in the kernel sees them as part of the packet data, or whether it removes them and puts them into metadata that has to be tested specially by a BPF program - then a new version of libpcap *could* help, as libpcap was recently changed to deal with that problem.