Its well known in the network world to avoid tagging with VLAN 1. Different vendors treat this in different ways and causes all sorts of hassles so most just avoid it.
Usually a tagged frame with vlan.id 0 is used for QoS - this allows the priority to come through without actually assigning a vlan. I see you are using tcpdump on a host - though a I am a big proponent of packet capture, I suggest that you take it to the next level - remove the end host behavior (is this a VM, perhaps?) and use a tap and grab the traffic off the link, not via the end host nor the transmitting device. Best to get a third party view of the problem at this point.