Suricata

batman-adv is a layer 2 encapsulation protocol often used by wireless mesh networks (i.e. Freifunk).
To monitor traffic that is batman-adv encapsulated, a new decoder is needed.

In the first step the decoder shall only strip the batman-adv header, enabling access to the ethernet frame within.
Later, metadata from the batman-adv header could be added, similar to vlan id or mpls tags.