I'm just wondering, what will be the best approch
to filter vlan tags when I
have Bro listening on two interfaces, which one needs to have a vlan
filter and the other doesn't?
Unfortunately you will have to modify Bro's internals to do that.
This is a general problem: when monitoring multiple interfaces, Bro currently
is structured to assume that they're all using the same link layer.