A basic Ethernet switch places its ports in one Layer 2 network. Broadcast and unknown-unicast traffic can reach every relevant port in that scope, and all learned MAC addresses share one forwarding context.

That design works for a small network. As the network grows, one flat Layer 2 domain creates broader broadcast traffic, larger failure impact, and fewer points where administrators can apply policy between groups of systems.

A Virtual Local Area Network, or VLAN, divides switching infrastructure into separate logical Layer 2 networks. Devices can connect to the same physical switches while belonging to different broadcast domains.

VLANs change the scope of Ethernet forwarding. Communication within one VLAN remains a Layer 2 operation. Communication between VLANs requires a Layer 3 forwarding function.

Consider an office with application servers, database servers, and management systems connected through the same switching infrastructure.

Without segmentation, they share one broadcast domain:

A broadcast from any host can reach all the others, and the switch learns every MAC address in one forwarding context.

VLANs create separate logical domains over the same physical equipment:

An Ethernet broadcast in VLAN 10 reaches eligible VLAN 10 ports. It does not enter VLAN 20 or VLAN 30 through ordinary Layer 2 forwarding.

The separation is logical. Hosts in the same VLAN can connect through different switches. Hosts on adjacent physical ports can belong to different VLANs and require routing to communicate.

A VLAN defines one logical Ethernet forwarding scope.

Within a VLAN, a switch:

The forwarding database is logically keyed by both VLAN and MAC address:

The same MAC value can therefore appear in two VLANs without referring to the same forwarding entry. Each occurrence belongs to a different Layer 2 scope.

ARP follows the same boundary. An ARP request sent in VLAN 10 remains within VLAN 10. A host in VLAN 20 does not receive that request through ordinary switching.

VLANs divide broadcast domains. They do not change the collision behavior of modern switched Ethernet. Each full-duplex switch port still has an independent link.

A switch must know which VLAN contains every received frame. The two common port behaviors are called access and trunk.

These names come from common switch configuration terminology. IEEE 802.1Q defines frame tagging and VLAN behavior, while vendors expose that behavior through their own port modes and commands.

Access Ports

An access port normally connects an endpoint that sends and receives untagged Ethernet frames. The switch associates those frames with one configured VLAN.

For example:

An untagged frame arriving on port 5 becomes part of VLAN 20 inside the switch. When the switch sends a VLAN 20 frame out that access port, it normally transmits the frame without an 802.1Q tag.

The endpoint sees ordinary Ethernet and does not need VLAN awareness. Its operating system may have no indication that the switch assigned the port to VLAN 20.

Access-port handling of unexpected tagged frames depends on the device and configuration. Secure configurations define the accepted frame types instead of assuming every tag should be trusted.

Trunk Ports

A trunk carries frames for multiple VLANs over one physical link. Trunks commonly connect:

The sender adds an IEEE 802.1Q tag so the receiver can associate each frame with the correct VLAN.

The frame belongs to VLAN 10 across the entire switching path. The tag appears on the trunk, while ordinary access-connected hosts receive untagged frames.

A trunk can restrict which VLANs it carries. An allowed-VLAN list reduces accidental exposure and prevents unused VLANs from consuming forwarding resources on that link.

An 802.1Q tag adds four bytes after the source MAC address and before the original EtherType:

The four bytes contain two fields:

The Tag Protocol Identifier, or TPID, occupies the position where an untagged frame stores EtherType. A receiver that sees 0x8100 interprets the following two bytes as tag information, then reads the original EtherType after the tag.

For a tagged IPv4 frame:

The switch recalculates the Ethernet FCS after inserting or removing a tag because the protected frame bytes changed.

The 16-bit Tag Control Information field, or TCI, contains three subfields:

Priority Code Point, or PCP, uses three bits to mark one of eight traffic classes. Network devices can use this value when selecting queues. A priority mark provides input to a quality-of-service policy; it does not reserve bandwidth or guarantee delivery.

Drop Eligible Indicator, or DEI, uses one bit. Congested devices can prefer dropping frames marked as eligible when policy supports that behavior.

VLAN Identifier, or VID, uses 12 bits. Twelve bits provide 4096 numeric values from 0 through 4095:

VLAN 1 often has default or control significance on switch platforms, but exact defaults and restrictions depend on the implementation. Production designs should treat vendor defaults as configuration that needs verification.

VLAN IDs have local administrative scope. VLAN 20 in one organization has no automatic relationship to VLAN 20 in another organization.

The 802.1Q tag increases the Ethernet frame by four bytes. An untagged frame with a 1500-byte payload is 1518 bytes from destination address through FCS. The tagged form is 1522 bytes:

The conventional IP MTU can remain 1500 bytes because the VLAN tag belongs to Ethernet overhead rather than to the IP payload.

Every link that carries tagged frames must accept the additional four bytes. Modern VLAN-aware Ethernet equipment normally supports this size. An older or misconfigured device can report the frame as oversized and discard it.

Tagging does not add application capacity. It adds classification metadata and consumes four additional transmitted bytes per frame.

A VLAN-aware switch processes a received frame in stages:

The internal forwarding decision always includes a VLAN context, even when the endpoint sent an untagged frame. Access-port configuration supplies that context.

The switch then learns and forwards within that VLAN. A known unicast uses a destination entry from the same VLAN. An unknown unicast or broadcast is flooded only through eligible ports that carry the VLAN.

Before transmission, the switch applies the outgoing port's tag behavior. One frame can therefore arrive untagged, cross several trunks with a tag, and leave untagged without changing its endpoint MAC addresses or enclosed IP packet.

Some trunk configurations designate one VLAN to carry untagged frames. This VLAN is often called the native VLAN or the port's untagged VLAN.

When an untagged frame arrives on such a trunk, the receiving switch assigns it to the configured native VLAN. Frames for that VLAN may leave the trunk untagged, although some platforms can tag all VLANs.

Both ends must agree on untagged-frame classification. A mismatch can place the same untagged frame into different VLANs at opposite ends:

Traffic that Switch A considers VLAN 10 can enter VLAN 20 at Switch B. The mismatch can cause connectivity failures, traffic leakage, and confusing address learning.

Explicit tagging reduces ambiguity. Where untagged trunk traffic remains necessary, matching configuration and monitoring are required.

A VLAN and an IP subnet belong to different layers.

A VLAN defines a Layer 2 broadcast and forwarding scope.

An IP subnet defines an address range and local-delivery assumption at Layer 3.

Networks commonly assign one IP subnet to each VLAN:

This one-to-one design keeps the Layer 2 and Layer 3 boundaries aligned. Hosts in VLAN 10 treat other VLAN 10 addresses as local. Addresses in VLAN 20 or VLAN 30 require a Layer 3 next hop.

The terms are not interchangeable. One VLAN can technically carry more than one IP subnet, although all of those addresses still share broadcasts and Layer 2 failures. Splitting one ordinary IP subnet across isolated VLANs causes a different problem: hosts can believe a destination is directly reachable and broadcast for it even though the VLAN boundary blocks that request.

Keeping one subnet per VLAN avoids these ambiguous reachability assumptions in conventional designs.

Two hosts in VLAN 10 can exchange frames through one or more switches without routing.

The sender resolves the destination's local MAC address, creates an Ethernet frame, and transmits it. Switches carry the frame only across links that belong to VLAN 10. Trunk links add or preserve a VLAN 10 tag as required.

The endpoint frame can contain:

The VLAN tag may not appear on either host's access link. It can exist only between VLAN-aware devices in the middle of the path.

An ARP broadcast from the sender also stays in VLAN 10. VLAN 20 hosts neither receive nor answer it through ordinary Layer 2 forwarding.

Two hosts in different VLANs need a Layer 3 forwarding function.

Consider an application server in VLAN 10 contacting a database in VLAN 20:

The application server determines that the database IP is outside its local subnet. It sends the first Ethernet frame to its VLAN 10 gateway.

The gateway removes the VLAN 10 frame, examines the IP destination, and creates a new frame in VLAN 20. That second frame uses the gateway's VLAN 20 source MAC and the database's destination MAC.

The endpoint IP addresses usually remain:

The VLAN contexts and Ethernet address pairs change at the Layer 3 boundary.

Two common designs provide the Layer 3 boundary.

Router with a Tagged Interface

A router can connect to a switch through an 802.1Q trunk. The router creates a logical subinterface for each VLAN and assigns each subinterface an IP address.

The switch sends tagged frames to the router. The VLAN ID selects the logical router interface. This design is often called router-on-a-stick because one physical link carries traffic for several VLANs.

All cross-VLAN traffic shares that link, so its capacity and availability affect every attached VLAN.

Layer 3 Switch

A Layer 3 switch can route between VLANs in the switching system. It creates a logical Layer 3 interface for each VLAN, commonly called a Switched Virtual Interface, or SVI.

Hosts use the interface in their own VLAN as a gateway. The device switches within a VLAN and routes when traffic crosses VLAN interfaces.

Both designs enforce the same layer boundary. The implementation location and physical path differ.

VLANs provide several operational benefits.

Broadcast containment: ARP and other Layer 2 broadcasts stay within one VLAN, reducing the number of endpoints that process them.

Failure containment: A duplicate address or excessive broadcast source confined to one VLAN does not automatically reach endpoints in other VLANs. Shared devices, trunks, and loops that carry several VLANs can still affect more than one segment.

Policy boundaries: Cross-VLAN traffic passes through a Layer 3 function where administrators can apply routing and security rules.

Logical organization: Systems can be grouped by function, ownership, environment, or sensitivity without requiring a separate physical switch for every group.

Controlled extension: A trunk can carry selected VLANs between switches, hypervisors, routers, and servers over one physical link.

Segmentation has a management cost. More VLANs require consistent port assignments, trunk policies, gateway interfaces, IP address plans, monitoring, and documentation. A VLAN should represent a meaningful boundary rather than serve as an arbitrary label.

A VLAN provides traffic separation in cooperating Layer 2 infrastructure. It does not encrypt frame contents, authenticate endpoints, or authorize application requests.

Hosts in the same VLAN can still send frames directly to one another unless additional controls prevent it. Traffic that routes between VLANs is allowed or denied according to the Layer 3 device's policy.

VLAN tags also should not be treated as trusted endpoint claims. An access port normally assigns VLAN membership from switch configuration. A trunk accepts tagged membership only for explicitly allowed VLANs and trusted peers.

Misconfigured trunks, unexpected tagged frames, native-VLAN mismatches, and unauthorized trunk negotiation can weaken segmentation. Switch configuration and port-level controls must enforce the intended boundary.

VLAN hopping describes techniques that attempt to send traffic into another VLAN through tagging or trunk misconfiguration. Disabling unnecessary trunk behavior, limiting allowed VLANs, rejecting unexpected tags, and aligning native-VLAN configuration reduce that risk.

Creating several VLANs on a switch does not create separate physical capacity.

A 1 Gbps trunk shared by VLANs 10, 20, and 30 still has 1 Gbps of physical link capacity. Frames from those VLANs compete for the outgoing link according to queueing and quality-of-service policy.

The PCP bits in an 802.1Q tag can influence queue selection, but they do not create bandwidth. A receiving device can also rewrite or ignore the priority value.

VLAN segmentation can reduce broadcast traffic seen by endpoints outside a VLAN. It does not reduce unicast traffic that must cross the same congested trunk, nor does it increase a switch's forwarding capacity.

Capacity planning must consider the combined traffic of all VLANs carried by a physical link.

Most endpoint devices connect through access ports and exchange untagged frames. Some systems participate directly in tagging.

A virtualization host can use one trunk to carry networks for several virtual machines. A server can create VLAN subinterfaces on one physical network interface. Each logical interface has its own VLAN ID and IP configuration.

Linux displays VLAN interfaces with:

An entry can resemble:

The name eth0.20 is a convention rather than a protocol requirement. The vlan ... id 20 output identifies the actual VLAN configuration.

A VLAN-aware endpoint must match the switch port's expectations. Sending tagged frames to an access port or sending an untagged frame where the trunk has no matching untagged VLAN can lead to drops or incorrect classification.

A capture taken on a trunk can display VLAN tags:

A tagged IPv4 frame can appear as:

The output shows:

Wireshark display filters include:

A capture on an access link normally contains no tag because the switch transmits an untagged frame to the endpoint.

Even on a VLAN-aware host, hardware offload can hide tags. A network interface can remove an incoming tag and pass the VLAN ID as metadata to the operating system, or insert an outgoing tag after the capture point. Capturing on the physical interface, logical VLAN interface, mirrored switch port, or external tap can therefore produce different views.

A missing visible tag proves little until the capture point and offload behavior are known.

VLAN failures often allow some communication while blocking another path. A structured check follows the frame from ingress classification to Layer 3 forwarding.

Verify Endpoint Configuration

Confirm the endpoint's IP address, prefix, gateway, physical interface, and any VLAN subinterface. An ordinary access-connected host should not create its own tag unless the port expects tagged traffic.

Verify Ingress VLAN Assignment

Identify whether the switch port expects tagged or untagged frames. For an access port, confirm the assigned VLAN. For a trunk, confirm the accepted tags and untagged-VLAN behavior.

Verify the Entire Trunk Path

Every trunk between source and destination must carry the VLAN. A VLAN allowed on the first trunk but omitted from a later trunk creates a partial path that can be difficult to distinguish from endpoint failure.

Check VLAN-Scoped MAC Learning

The endpoint MAC should appear in the forwarding context for the expected VLAN and port. Learning the correct MAC in the wrong VLAN indicates classification or tagging mismatch.

Test Same-VLAN Delivery First

If two hosts in the same VLAN cannot communicate, investigate access assignment, trunk carriage, MAC learning, local address resolution, and physical links before examining inter-VLAN routing.

Check the Layer 3 Boundary

For cross-VLAN traffic, confirm that each VLAN has the intended gateway interface and that routing and policy permit the flow. Working same-VLAN communication does not establish that the cross-VLAN path is configured.

Inspect Tags at a Relevant Capture Point

Capture on a trunk or mirrored switch port when tag visibility matters. Account for hardware offload before interpreting an untagged host capture.

Common symptoms include:

Only local VLAN works: The gateway interface, route, or cross-VLAN policy is missing or incorrect.

One switch works, another does not: A trunk may omit the VLAN or use inconsistent tagging.

Untagged traffic enters the wrong VLAN: Native or untagged-VLAN settings differ across the link.

Some large frames fail: A device along the tagged path may reject the additional frame size or use an inconsistent MTU.

MAC entries appear in the wrong VLAN: Ingress classification, access assignment, endpoint tagging, or trunk configuration is incorrect.

A VLAN is not an IP subnet. A VLAN creates a Layer 2 domain, while a subnet defines Layer 3 addressing. Designs commonly align them one-to-one.

A trunk is not a faster link. It carries several VLANs over one physical connection whose capacity remains shared.

Tags do not need to reach ordinary endpoints. Access ports can add VLAN context on ingress and remove the tag on egress.

Hosts in different VLANs require Layer 3 forwarding. Physical proximity and connection to the same switch do not bypass the VLAN boundary.

VLANs contain broadcasts rather than eliminating them. Each VLAN still carries broadcasts among its member ports.

A VLAN is not encryption. Tags identify a forwarding context and provide no confidentiality or endpoint authentication.

VLAN IDs are locally significant. Reusing an ID elsewhere does not connect the networks.

VLANs divide shared switching infrastructure into separate Layer 2 broadcast and MAC-learning domains. Access ports normally connect untagged endpoints to one VLAN, while trunks carry multiple VLANs using IEEE 802.1Q tags. Switches learn, forward, and flood frames only within their VLAN context.

The four-byte 802.1Q tag contains a TPID plus priority, drop eligibility, and a 12-bit VLAN ID. IDs 1 through 4094 identify ordinary VLANs, while 0 and 4095 have special meanings. A tagged frame can reach 1522 bytes while retaining a 1500-byte payload.

Traffic within a VLAN uses Layer 2 forwarding; traffic between VLANs requires routing. Networks commonly assign one IP subnet per VLAN to align these boundaries. VLANs contain broadcasts and support policy boundaries, but provide neither encryption nor authentication. Troubleshooting depends on trunk policy, native-VLAN consistency, endpoint tagging, and capture location.

VLANs let one physical Ethernet infrastructure support several isolated forwarding domains connected through explicit Layer 3 boundaries.