you can actually use linux to "decode" 802.1q (vlan tagging). you can effectively turn linux into a "router on a stick" and route between vlans, with a single ethernet port, on a fancy cisco layer 2 switch (that has lots of vlans).
the main ethernet has "subinterfaces" which correscpond with the vlan id. you can then route, and iptables (firewall) the subinterfaces individually.
this is an easy way to have a perimeter linux firewall connected to isp, and 10 vlans behind it, but only using a single ethernet interface.
dot q is the standard, even tho cisco thinks it made it up, so it runs great on linux.
EDIT: to enable this
you can then run tcpdump to listen on the subinterfaces