diff --git a/src/lstack/netif/lstack_ethdev.c b/src/lstack/netif/lstack_ethdev.c
index f2ec977537c429c8179daa1c4e03ba3269ea4404..cecf8c41889e1fb99e8e40b7f0a13b95554e47e4 100644
--- a/src/lstack/netif/lstack_ethdev.c
+++ b/src/lstack/netif/lstack_ethdev.c
@@ -95,6 +95,22 @@ static void stack_broadcast_arp(struct rte_mbuf *mbuf, struct protocol_stack *cu
     return;
 }
 
+err_t offload_check_vlan_hdr(uint16_t vlan_tci, uint64_t ol_flags, struct netif *netif)
+{
+#if GAZELLE_ENABLE
+    /* vlan header has't been offloaded by NIC, do nothing and return */
+    if (ol_flags & RTE_MBUF_F_RX_VLAN == 0) {
+        return ERR_OK;
+    }
+    /* 1. if vlan mode it not enable, ignore VLAN packets.
+     * 2. if vlan mode is enable, ignore packets not for our VLAN */
+    if (netif->vlan_enable == false || (netif->vlan_enable && (lwip_htons(vlan_tci) & 0xFFF) != netif->vlan_tci)) {
+        return ERR_RTE;
+    }
+#endif
+    return ERR_OK;
+}
+
 void eth_dev_recv(struct rte_mbuf *mbuf, struct protocol_stack *stack)
 {
     int ret;
@@ -102,8 +118,9 @@ void eth_dev_recv(struct rte_mbuf *mbuf, struct protocol_stack *stack)
     struct pbuf *prev = NULL;
     struct pbuf *head = NULL;
     struct rte_mbuf *m = mbuf;
-    uint16_t len, pkt_len;
+    uint16_t len, pkt_len, vlan_tci;
     struct rte_mbuf *next_m = NULL;
+    uint64_t ol_flags;
 
     pkt_len = (uint16_t)rte_pktmbuf_pkt_len(m);
 
@@ -116,6 +133,8 @@ void eth_dev_recv(struct rte_mbuf *mbuf, struct protocol_stack *stack)
 
         if (head == NULL) {
             head = next;
+            vlan_tci = m->vlan_tci;
+            ol_flags = m->ol_flags;
         }
         if (prev != NULL) {
             prev->next = next;
@@ -130,6 +149,13 @@ void eth_dev_recv(struct rte_mbuf *mbuf, struct protocol_stack *stack)
     }
 
     if (head != NULL) {
+        ret = offload_check_vlan_hdr(vlan_tci, ol_flags, $stack->netif);
+        if (ret != ERR_OK) {
+            LSTACK_LOG(ERR, LSTACK, "eth_dev_recv: vlan header was offloaded and vlan id is not allowd ret=%d\n", ret);
+            stack->stats.rx_drop++;
+            pbuf_free(head);
+            return;
+        }
         ret = stack->netif.input(head, &stack->netif);
         if (ret != ERR_OK) {
             LSTACK_LOG(ERR, LSTACK, "eth_dev_recv: failed to handle rx pbuf ret=%d\n", ret);