decode: fix offset for DCE layer

Fixes: 136d351e403b ("decode: single network layer entrypoint")
Ticket: #3637

diff --git a/src/decode.h b/src/decode.h
index 1a844525dafc03be32a6d3bad52f82b34a3d494d..0627bea7f2166ba25578ea16b07c07ef1f7f0f3d 100644 (file)
--- a/src/decode.h
+++ b/src/decode.h
@@ -1202,7 +1202,8 @@ static inline bool DecodeNetworkLayer(ThreadVars *tv, DecodeThreadVars *dtv,
             if (unlikely(len < ETHERNET_DCE_HEADER_LEN)) {
                 ENGINE_SET_INVALID_EVENT(p, DCE_PKT_TOO_SMALL);
             } else {
-                DecodeEthernet(tv, dtv, p, data, len);
+                // DCE layer is ethernet + 2 bytes, followed by another ethernet
+                DecodeEthernet(tv, dtv, p, data + 2, len - 2);
             }
             break;
         case ETHERNET_TYPE_VNTAG: