af-packet bpf filtering failed to select multiple vlan
This issue is not related to Suricata but common to all tools using BPF (ex: tcpdump).
- we are receiving 8021q traffic on the interface on which suricata is listening
- we only want to inspect traffic on specific vlan
- using bpf (af-packet), we tried filtering on 'vlan X or vlan Y' and '(vlan X) or (vlan Y)' but neither worked
We are aware that the problem is due to the bpf code generation which writes it so that Y is supposed to be encapsulated in X. This is documented in several places, including 
Still writing this issue after discussing it w/ Eric Leblond @suricon, in case some (e)BPF-fu can solve this :)