decode: fix offset for DCE layer

Fixes: 136d351e40 ("decode: single network layer entrypoint") Ticket: #3637
2 years ago · fdf9cdf400
parent 9a33c536c0
commit fdf9cdf400
1 changed files with 2 additions and 1 deletions
--- a/src/decode.h
+++ b/src/decode.h
@ -1202,7 +1202,8 @@ static inline bool DecodeNetworkLayer(ThreadVars *tv, DecodeThreadVars *dtv,
            if (unlikely(len < ETHERNET_DCE_HEADER_LEN)) {
                ENGINE_SET_INVALID_EVENT(p, DCE_PKT_TOO_SMALL);
            } else {
-                DecodeEthernet(tv, dtv, p, data, len);
+                // DCE layer is ethernet + 2 bytes, followed by another ethernet
+                DecodeEthernet(tv, dtv, p, data + 2, len - 2);
            }
            break;
        case ETHERNET_TYPE_VNTAG: