From ce67172bbf0f4c37ca59ee8fbd5e24369ec15f1a Mon Sep 17 00:00:00 2001
From: Philippe Antoine <pantoine@oisf.net>
Date: Fri, 30 Jun 2023 10:45:37 +0200
Subject: [PATCH] decode: fix offset for DCE layer

Fixes: 136d351e403b ("decode: single network layer entrypoint")

Ticket: #3637
(cherry picked from commit fdf9cdf40068f00147bb07dd3f41a7556b8de823)
---
 src/decode.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/decode.h b/src/decode.h
index 3c160c220ae7..e4fed6f6464b 100644
--- a/src/decode.h
+++ b/src/decode.h
@@ -1327,7 +1327,8 @@ static inline bool DecodeNetworkLayer(ThreadVars *tv, DecodeThreadVars *dtv,
             if (unlikely(len < ETHERNET_DCE_HEADER_LEN)) {
                 ENGINE_SET_INVALID_EVENT(p, DCE_PKT_TOO_SMALL);
             } else {
-                DecodeEthernet(tv, dtv, p, data, len);
+                // DCE layer is ethernet + 2 bytes, followed by another ethernet
+                DecodeEthernet(tv, dtv, p, data + 2, len - 2);
             }
             break;
         case ETHERNET_TYPE_VNTAG: