Trunk

A trunk carries its allowed VLANs tagged, and one, the native VLAN (1 unless set), untagged: an untagged frame arriving on a trunk is filed in it, so both ends must agree. VLAN 1 is the default VLAN every port starts in. A VLAN missing from the allowed list at either end of a trunk is cut in two there. On IOS: switchport mode trunk, switchport trunk allowed vlan, switchport trunk native vlan, show interfaces trunk.

How a VLAN trunk works, step by step

A trunk is one link that carries several VLANs, each frame tagged with an IEEE 802.1Q header naming its VLAN. It is how VLANs cross from switch to switch, so a department can sit on any floor. In the VLAN trunks lab a coreSwitch and a floorSwitch are joined by one trunk carrying VLANs 1, 10 (sales, 10.0.10.0/24), 20 (engineering, 10.0.20.0/24) and 30 (voice, 10.0.30.0/24).

1. A PC sends an untagged frame into its access port. The switch files it in that port's VLAN, say 10 for bob.
2. The frame reaches the trunk and leaves tagged. The switch inserts the 4-byte 802.1Q tag (0x8100, then a 3-bit priority, 1 drop-eligible bit and the 12-bit VLAN ID) so the far switch knows which VLAN it belongs to.
3. The far switch reads the tag and forwards only within VLAN 10, then strips the tag at bob's access port, so the receiving PC never sees it.
4. The allowed VLANs decide what crosses. A trunk carries only the VLANs on its allowed list; a frame for any other VLAN is dropped at the port. A VLAN missing from the list at either end is cut in two there.
5. One VLAN crosses untagged: the native VLAN, 1 unless set. An untagged frame arriving on a trunk is filed in the native VLAN, so both ends must agree, or frames leak between VLANs.

The default VLAN every port starts in is VLAN 1, and it cannot be deleted. Routing between the VLANs still needs a router or a layer 3 switch with an address in each.

What it looks like on a Linux machine

The switches are Linux bridges with VLAN filtering, so bridge vlan show is their show interfaces trunk. An access port carries one VLAN, untagged both ways:

$ bridge vlan show dev bob
port              vlan-id
bob               10 PVID Egress Untagged

PVID means untagged frames coming in join VLAN 10; Egress Untagged means VLAN 10 leaves without a tag. A trunk port is different: several VLANs tagged (no flags), and the native VLAN untagged:

$ bridge vlan show dev coreSwitch
port              vlan-id
coreSwitch        1 PVID Egress Untagged
                  10
                  20
                  30

On the cable, a capture shows the tag. tcpdump -e prints the link layer:

$ tcpdump -e -nn -i coreSwitch
... 802.1Q (0x8100), length 102: vlan 10, p 0, ethertype IPv4 (0x0800), 10.0.10.10 > 10.0.10.11: ICMP echo request

Length 102 is a 98-byte ping frame plus the 4-byte tag. Removing a VLAN from the trunk is one command:

$ bridge vlan del dev coreSwitch vid 20

and VLAN 20 is cut at that port while VLAN 10 keeps crossing the same cable.

What goes wrong, and how you see it

A VLAN missing from the trunk's allowed list. Devices in that VLAN on different switches cannot reach each other, while every other VLAN works over the same cable. bridge vlan show on the trunk port is missing the VLAN; add it back with bridge vlan add dev <port> vid 20.

Native VLAN mismatch. Each end sends untagged frames for a different VLAN, so traffic leaks from one into the other. A plain Linux bridge gives no warning (managed switches log a native VLAN mismatch); the fix is a native VLAN that both ends agree on and no host uses.

The allowed list clobbered. Editing one VLAN out of a trunk by hand can take the rest with it, when the command sets the whole allowed list instead of adding or removing one VLAN. On a Linux bridge each bridge vlan del or add names one VLAN, so it changes only that one; check bridge vlan show on both ends after any change.

VLAN hopping by double tagging. An attacker on the native VLAN sends a frame with two tags; the first switch strips the native outer tag and the inner tag carries it into another VLAN, one way. Keeping hosts off the native VLAN stops it. The VLAN trunks lab shows the double-tagged frame being filed back in VLAN 1 once the native VLAN is changed.

Questions people ask

Trunk port vs access port? An access port belongs to one VLAN and carries untagged frames for an end device; a trunk carries many VLANs, tagged, between switches, routers and hypervisors.

What is the native VLAN? The one VLAN a trunk carries untagged. An untagged frame on the trunk is filed in it. Best practice is to set it to an unused VLAN so nothing rides it by accident.

Is VLAN 1 special? It is the default VLAN every port starts in and cannot be deleted. Leaving users or the native VLAN on VLAN 1 is discouraged; give management its own VLAN. See VLAN and the VLANs lab.

See it on real machines