How to listen for only on some VLANs

Please include the following information with your help request:

  • Suricata version 7.0.5
  • Debian 12
  • Installed from stable-backpots Debian

I’m trying to only listen for 3 vlans let’s say 100 101 102 how can I implement this in suricata i have tried the following but didn’t work

Inside suricata.yaml

      - id: 100
      - id: 101
      - id: 102
bpf-filter: "vlan 100 or vlan 101 or vlan 102"
  • The version is suricata-6.0.15
  • The operating system is Ubuntu 20.

I am able to add application layer protocols, but I would like to ask if it is possible to add Profinet DCP, an Ethernet link layer protocol. How should it be added to Suricata? Is it the same process as adding application layer protocols?