VLANs and trunks
One switch can act like several separate networks. Watch two switches split into a staff VLAN and a guest VLAN: frames pick up a 4-byte 802.1Q tag to share a trunk cable, lose it again at the far end, broadcasts never leave their own VLAN, and the only way between VLANs is through a router.
5 quick questions
Pick an answer to see why. Your score saves with your progress.
01Guest B sends a broadcast in VLAN 20. Which devices receive it?
A VLAN is a broadcast domain. The switches flood the broadcast only to ports in VLAN 20, including across the trunk, so staff devices in VLAN 10 never see it.
02What does a switch add to a frame before sending it over a trunk (outside the native VLAN)?
The tag (TPID 0x8100 plus priority, drop bit and a 12-bit VLAN ID) goes right after the source MAC, so the far switch knows which VLAN the frame belongs to.
03Why can VLAN IDs only go from 1 to 4094?
12 bits give 0 to 4095. VID 0 means "priority only, no VLAN" and 4095 is reserved, which leaves 4094 usable VLANs.
04A frame arrives on a trunk port with no tag at all. Which VLAN does the switch put it in?
Untagged frames on a trunk belong to the native VLAN, the port's PVID in IEEE 802.1Q terms. That is why both ends of a trunk must use the same native VLAN.
05Staff A (VLAN 10) and Guest A (VLAN 20) are plugged into the same switch. How does a packet get from one to the other?
Different VLANs are different networks. The switch never forwards a frame from one VLAN into another, so traffic between them goes through a router (here on a trunk, tagged 10 in and 20 out).
Glossary
- VLAN
- Virtual LAN: a group of switch ports that behaves like its own separate network, even though it shares the hardware with other VLANs.
- Broadcast domain
- The set of devices a broadcast frame (to ff:ff:ff:ff:ff:ff) reaches. Each VLAN is one broadcast domain.
- Access port
- A switch port that belongs to exactly one VLAN. Frames leave it without a tag, so the device needs no VLAN support.
- Trunk port
- A switch port that carries several VLANs over one cable, telling them apart with 802.1Q tags.
- 802.1Q tag
- 4 bytes inserted after the source MAC: TPID 0x8100, then 3 priority bits, 1 drop-eligible bit and a 12-bit VLAN ID.
- VLAN ID (VID)
- The 12-bit number that names a VLAN. Values 1 to 4094 are usable; 0 and 4095 are reserved.
- Native VLAN
- The one VLAN a trunk sends without a tag (VLAN 1 by default). IEEE 802.1Q calls it the port VLAN ID, or PVID.
- Inter-VLAN routing
- Moving packets between VLANs through a router, because a switch keeps each VLAN's frames apart.
Notes and sources
- MAC addresses 00:00:5e:00:53:01-05 are RFC 7042 documentation values; ff:ff:ff:ff:ff:ff is the real broadcast address. The two office networks 192.168.10.0/24 and 192.168.20.0/24 are private ranges (RFC 1918).
- IEEE 802.1Q: the tag is a 2-byte TPID (0x8100) and a 2-byte control field: priority (PCP, 3 bits), drop eligible (DEI, 1 bit) and VLAN ID (12 bits). VID 0 means "priority only, no VLAN" and 4095 is reserved.
- The tag makes a frame 4 bytes longer: the largest Ethernet frame grows from 1518 to 1522 bytes (IEEE 802.3).
- "Native VLAN" is vendor wording. IEEE 802.1Q calls it the port VLAN ID (PVID), which is 1 by default, and lists per VLAN which ports send it untagged.
- Switches keep a separate MAC table for each VLAN. Here both switches have already learned every address (see "How a switch learns").
- Frames cross a switch in microseconds; the figure slows everything down so you can watch.
Quiz Unlocks after the last step.