VLAN packets show when running directly but not when reading from file

[kaistian]

tcpdump version 4.99.5
libpcap version 1.10.4 (with TPACKET_V3)
OpenSSL 3.3.2 3 Sep 2024

When i run tcpdump -ei bond0 host 10.2.104.113 and icmp on the machine I get output of ICMP packets with VLAN.

But when I run tcpdump -i bond0 -w icmp-vlan-tagged.pcap and then
tcpdump -er icmp-vlan-tagged.pcap host 10.2.104.113 and icmp
I don't get any output at all.

To make it work when reading from file I need to add vlan and at the start
tcpdump -er icmp-vlan-tagged.pcap vlan and host 10.2.104.113 and icmp

Shouldn't the first expression work no mater where I get the input data from?

[kaistian]

I don't know if it's useful, but I have a pcap file with one icmp packet in it, it was captured on Ubuntu 24.04 with
tcpdump version 4.99.1
libpcap version 1.10.1 (with TPACKET_V3)
OpenSSL 3.0.2 15 Mar 2022

icmp-vlan-tagged.pcap.gz

[infrastation]

This looks very similar to #1387.

[kaistian]

Yes, I was just about to close this as same as #1387.