diff --git a/pkg/network/filter/packet_source_linux.go b/pkg/network/filter/packet_source_linux.go
index 65fbbe9f9270f..d0d493f82987a 100644
--- a/pkg/network/filter/packet_source_linux.go
+++ b/pkg/network/filter/packet_source_linux.go
@@ -155,7 +155,14 @@ func (p *AFPacketSource) VisitPackets(exit <-chan struct{}, visit func(data []by
 			return err
 		}
 
-		pktInfo.PktType = stats.AncillaryData[0].(afpacket.AncillaryPktType).Type
+		for _, data := range stats.AncillaryData {
+			// if addPktType = true, AncillaryData will contain an AncillaryPktType element;
+			// however, it might not be the first element, so scan through.
+			pktType, ok := data.(afpacket.AncillaryPktType)
+			if ok {
+				pktInfo.PktType = pktType.Type
+			}
+		}
 		if err := visit(data, pktInfo, stats.Timestamp); err != nil {
 			return err
 		}
diff --git a/releasenotes/notes/system-probe-vlan-2aea22b74ae91c32.yaml b/releasenotes/notes/system-probe-vlan-2aea22b74ae91c32.yaml
new file mode 100644
index 0000000000000..a0937fec1c607
--- /dev/null
+++ b/releasenotes/notes/system-probe-vlan-2aea22b74ae91c32.yaml
@@ -0,0 +1,11 @@
+# Each section from every release note are combined when the
+# CHANGELOG.rst is rendered. So the text needs to be worded so that
+# it does not depend on any information only available in another
+# section. This may mean repeating some details, but each section
+# must be readable independently of the other.
+#
+# Each section note must be formatted as reStructuredText.
+---
+fixes:
+  - |
+    Fixes an error in system-probe triggered by packet capture in environments with multiple VLANs.