> > but if i run tcpdump on vlan device (*not* on the parent device) > > i'd expect to see normal frames, not the encapsulated frames... >You do... it passes it to bpf after decapsulating. see, i read the patch wrongly. itojun