diff --git a/doc/userguide/capture-hardware/dpdk.rst b/doc/userguide/capture-hardware/dpdk.rst
index 757484d048..2b8d57c98e 100644
--- a/doc/userguide/capture-hardware/dpdk.rst
+++ b/doc/userguide/capture-hardware/dpdk.rst
@@ -231,3 +231,12 @@ other cards.
 Setting the value to 0 causes Suricata to skip the link check.
 If the interface's link remains down after the timeout period, Suricata warns
 the user but continues with the engine initialization.
+
+.. _dpdk-encapsulation-stripping:
+
+Encapsulation stripping
+-----------------------
+
+Suricata supports stripping the hardware-offloaded encapsulation stripping on
+the supported NICs. Currently, VLAN encapsulation stripping is supported.
+VLAN encapsulation stripping can be enabled with `vlan-strip-offload`.
diff --git a/doc/userguide/configuration/suricata-yaml.rst b/doc/userguide/configuration/suricata-yaml.rst
index 5b83480e62..41f372d66c 100644
--- a/doc/userguide/configuration/suricata-yaml.rst
+++ b/doc/userguide/configuration/suricata-yaml.rst
@@ -2183,6 +2183,7 @@ The whole DPDK configuration resides in the `dpdk:` node. This node encapsulates
           multicast: true
           checksum-checks: true
           checksum-checks-offload: true
+          vlan-strip-offload: true
           linkup-timeout: 10
           mtu: 1500
           mempool-size: auto