You might be capturing on what might be called a “VLAN interface” – the way a particular OS makes VLANs plug into the networking stack might, for example, be to have a network device object for the physical interface, which takes VLAN packets, strips off the VLAN header and constructs an Ethernet header, and passes that packet to an internal network device object for the VLAN, which then passes the packets ONTO VARIOUS higher-level protocol implementations.

In order to see the raw Ethernet packets, RATHER than “de-VLANized” packets, you would have to capture not on the virtual interface for the VLAN, but on the interface corresponding to the physical network device, if possible.

You might be capturing on what might be called a “VLAN interface” – the way a particular OS makes VLANs plug into the networking stack might, for example, be to have a network device object for the physical interface, which takes VLAN packets, strips off the VLAN header and constructs an Ethernet header, and passes that packet to an internal network device object for the VLAN, which then passes the packets onto various higher-level protocol implementations.

In order to see the raw Ethernet packets, rather than “de-VLANized” packets, you would have to capture not on the virtual interface for the VLAN, but on the interface corresponding to the physical network device, if possible.