on Bro2.4, in Sessions.cc, pkt->hdr_size=0 for all vlan tagged packets.
This effects the calculation of :
uint32 caplen = pkt->cap_len - pkt->hdr_size = pkt->cap_len - 0
It affects both UDP.cc and TCP.cc because the test of :
if ( caplen >= len ) passes and the packets are then passed to ForwardPacket and to the relevant analyzer.
On Bro2.5 however, the pkt-hdr_size is calculated properly in Sessions.cc, so caplen is smaller.
Although the caplen is now correct, the test of :
if ( caplen >= len ) fails, and the packets are not forwarded to the suitable analyzer.
Our patch to this issue is to ignore the if (caplen>=len) condition.
I am doubtful if this if condition does serves the purpose it was created for, which is not forwarding the packet in case caplen=0 ?
ubuntu server 16.04