we were puzzled by VLAN id’s in the conn.log with values > 4095 (it’s a 12-bit value so 4095 is the maximum). One of the most reported values (in our case) was 16413. After some packet capturing and analysis with Wireshark I found this:
Usually the Priority field is 0, meaning ‘best effort’ but occasionally is it set to a value of 2.
If you now convert the entire 16 bit value (instead of only the last 12 bits) and convert it to decimal, you get this:
$ bc -q
Zeek version running on that particular system is 5.1.1.