The SAP encapsulation definition on Ethernet ingress ports defines which VLAN tags are used to determine the service to which the packet belongs:
Null encapsulation defined on ingress — Any VLAN tags are ignored and the packet goes to a default service for the SAP.
Dot1q encapsulation defined on ingress — Only first label is considered.
QinQ encapsulation defined on ingress— Both labels are considered. The SAP can be defined with a wildcard for the inner label (for example, ‟100:100.*”). In this situation, all packets with an outer label of 100 are treated as belonging to the SAP. If on the same physical link, there is also an SAP defined with a QinQ encapsulation of 100:100.1, then traffic with 100:1 goes to that SAP and all other traffic with 100 as the first label goes to the SAP with the 100:100.* definition.
In situations 2 and 3 above, traffic encapsulated with tags for which there is no definition are discarded.