Virtual LANs
A plain switch is one broadcast domain: every broadcast reaches every port. That is fine for a handful of machines, but on a big switch you often want isolated groups - engineering separate from finance, guest Wi-Fi separate from the corporate network - without buying a switch per group and cabling them apart.
A VLAN (Virtual LAN) solves this by partitioning one physical switch into several logical switches. Each VLAN is its own broadcast domain: a broadcast in VLAN 10 reaches only the ports in VLAN 10, as if those ports were a separate switch entirely. Traffic between VLANs must go through a router (or a layer-3 switch), just like traffic between two physical LANs.
Access ports and trunk ports
Ports come in two flavors:
- An access port belongs to exactly one VLAN. The host plugged in is unaware VLANs exist - it sends and receives ordinary untagged frames, and the switch associates everything on that port with the port's VLAN.
- A trunk port carries traffic for many VLANs at once, typically between switches or to a router. Because one wire now mixes multiple VLANs, each frame must say which VLAN it belongs to.
802.1Q tagging
That labeling is 802.1Q. The switch inserts a 4-byte VLAN tag into the Ethernet frame, between the source MAC and the type field. The tag's key piece is a 12-bit VLAN ID (1-4094), naming the VLAN the frame belongs to.
Tags live only on trunk links. A switch adds the tag when a frame leaves an access port onto a trunk, and strips it before delivering the frame out an access port to the end host. So hosts never see tags; only the switch-to-switch and switch-to-router links carry them.
The 802.1Q tag adds 4 bytes: a 2-byte tag protocol identifier (0x8100, which flags the frame as tagged) plus 2 bytes holding the 12-bit VLAN ID and a 3-bit priority field for QoS. Because it inserts bytes into the frame, the FCS is recomputed. A frame with no tag is called untagged and belongs to the trunk's native VLAN.
A worked tag: VLAN 20
Say a frame belongs to VLAN 20. The switch inserts these 4 bytes right after the source MAC:
| Bytes | Field | Value | Meaning |
|---|---|---|---|
| 2 | TPID | 0x8100 | Marks this as an 802.1Q-tagged frame |
| 1.5 (12 bits) | VLAN ID | 20 -> 0x014 | 20 in binary is 0000 0001 0100, right-padded into the 12-bit VID |
| 0.375 (3 bits) | Priority (PCP) | 0 | 802.1p priority for QoS, unrelated to VLAN membership |
| 0.125 (1 bit) | DEI | 0 | Drop-eligible indicator, rarely set |
Packed together, the TCI (priority + DEI + VLAN ID) is 0x0014, so the full
4-byte tag on the wire reads 81 00 00 14. Any switch that reads this tag
knows immediately, without touching the payload, which of its 4094 possible
broadcast domains this frame belongs to.
The native VLAN (the one whose frames travel untagged on a trunk) is a per-port setting - nothing forces both ends of a trunk cable to agree on it. If switch A treats VLAN 1 as native and switch B treats VLAN 99 as native on the same trunk, an untagged frame crossing that link is silently reinterpreted as belonging to a different VLAN than the sender intended - traffic leaks between VLANs that were supposed to be isolated. Worse, this mismatch is also what the classic double-tagging VLAN hopping attack exploits: an attacker crafts a frame with two stacked 802.1Q tags, the outer one matching the trunk's native VLAN. The first switch strips the outer tag (since native-VLAN traffic is untagged) and forwards what is left - a frame still tagged with the attacker's target VLAN - onto the trunk, where the next switch honors that inner tag and delivers the frame straight into a VLAN the attacker was never a member of. The standard fix is to never use VLAN 1 (or any in-use VLAN) as the native VLAN on trunk ports, and to keep native VLAN settings identical on both ends of every trunk.
Why VLANs
- Segmentation - group hosts by function or department regardless of where they physically plug in, and keep each group's broadcast traffic contained so it does not flood the whole site.
- Security - hosts in different VLANs cannot reach each other at the link layer; all cross-VLAN traffic is forced through a router where firewall rules and access control can be applied.
- Flexibility - moving a host to a different network is a config change (put its port in another VLAN), not a recabling job.