> Is it possible to take a datastream, either from a ethereal capture
> file, or live, and remove vlan tags so that other, less vlan friendly,
> packages can perform analysis on the output?
It would be possible to write a program to to that, using libpcap; I
don't know of any programs that already do that, though.
There's a Perl module (Net::Raw or something such as that) which
provides a libpcap interface, so it could perhaps be written in Perl;
there may be packages for other somewhat more convenient languages than
C as well.
Of course, if you do that:
> I have a variety of tools and utilities that I use to parse tcpdump type
> output for performing statistical analysis, but they're barfing on the
> data captured by tcpdump 3.6.2 and tethereal 0.8.16 due to the vlan
> headers.
...if you have the source to those tools, another possibility would be
to just teach those tools how to handle VLAN frames.