From 1fe008945ed3a2208d96dc389d0d0893eb9d6da3 Mon Sep 17 00:00:00 2001
From: Jan Grashoefer <jan.grashoefer@gmail.com>
Date: Fri, 25 Sep 2020 18:42:47 +0200
Subject: [PATCH] af_packet: Hacked VLAN support.

---
 src/iosource/af_packet/src/AF_Packet.cc | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/src/iosource/af_packet/src/AF_Packet.cc b/src/iosource/af_packet/src/AF_Packet.cc
index dae80820ac..48cb98874d 100644
--- a/src/iosource/af_packet/src/AF_Packet.cc
+++ b/src/iosource/af_packet/src/AF_Packet.cc
@@ -245,11 +245,14 @@ bool AF_PacketSource::ExtractNextPacket(zeek::Packet* pkt)
 
         pkt->Init(props.link_type, &current_hdr.ts, current_hdr.caplen, current_hdr.len, data);
 
-        if ( current_hdr.len == 0 || current_hdr.caplen == 0 )
-            {
-            Weird("empty_af_packet_header", pkt);
-            return false;
-            }
+		if ( packet->tp_status & TP_STATUS_VLAN_VALID )
+			pkt->vlan = packet->hv1.tp_vlan_tci;
+
+		if ( current_hdr.len == 0 || current_hdr.caplen == 0 )
+			{
+			Weird("empty_af_packet_header", pkt);
+			return false;
+			}
 
         stats.received++;
         stats.bytes_received += current_hdr.len;