Splitting a switch
A VLAN (virtual LAN) splits one physical switch into separate networks. Here each port is set to VLAN 10 (blue, staff) or VLAN 20 (pink, guests). Each VLAN is its own broadcast domain: the devices one broadcast can reach.
Each laptop plugs into an access port: a port that belongs to exactly one VLAN. Staff laptops are in VLAN 10, guest laptops in VLAN 20. The laptops know nothing about VLANs. They send ordinary Ethernet frames.
Across a trunk
Staff A sends a frame to Staff B, who is on the other switch. It leaves with no tag. It enters Switch 1 on port 1, an access port in VLAN 10, so the switch files it under VLAN 10.
Switch 1 sends it over the trunk: one cable that carries many VLANs between switches. To keep them apart, it inserts a 4-byte 802.1Q tag holding the VLAN ID, 10, just after the source MAC address.
The tag starts with 0x8100, which marks it as an 802.1Q tag. Then come 3 priority bits, 1 drop bit and a 12-bit VLAN ID. 12 bits give 4096 values; 0 and 4095 are reserved, so VLANs 1 to 4094 are usable.
Switch 2 reads VLAN ID 10, so the frame may only leave through VLAN 10 ports. It removes the tag and sends the plain frame out of port 2 to Staff B, exactly as Staff A sent it.
Broadcasts
Guest B sends a broadcast: a frame to ff:ff:ff:ff:ff:ff, meaning everyone. Here it is an ARP question. It arrives on port 3, an access port in VLAN 20, so it is a VLAN 20 broadcast.
The switches flood it only to VLAN 20 ports. It crosses the trunk tagged 20, and Switch 1 hands copies to Guest A and to the router's VLAN 20 side. Staff A and Staff B never see it.
Native VLAN
One VLAN per trunk, the native VLAN, crosses with no tag. It is VLAN 1 unless you change it. The far switch puts every untagged frame it gets into its own native VLAN, so both ends must agree.
Between VLANs
Staff A cannot reach Guest A directly, even on the same switch: different VLANs are different IP networks. The frame goes to the router, tagged 10. The router routes the packet, sends it back tagged 20, and Switch 1 delivers it untagged.
Inside the frame
;; step 1/10 · two-vlans · idle
Switch 1 port 1 access VLAN 10 · port 2 access VLAN 20
port 3 trunk to Switch 2 · port 4 trunk to the router
Switch 2 port 1 trunk to Switch 1
port 2 access VLAN 10 · port 3 access VLAN 20
VLAN 10 Staff 192.168.10.0/24
VLAN 20 Guest 192.168.20.0/24
Switches keep a separate MAC table for each VLAN. Here both switches have already learned every address (see "How a switch learns"). "Native VLAN" is vendor wording. IEEE 802.1Q calls it the port VLAN ID (PVID), which is 1 by default, and lists per VLAN which ports send it untagged.