Hack the Route Start free Open app Switches and VLANs
VLAN
Several separate networks on one switch, kept apart by a tag in each frame.
An 802.1Q tag of 4 bytes (0x8100 plus a 12-bit VLAN ID, 1 to 4094) follows the MAC addresses. An access
port belongs to one VLAN and its device never sees tags; a trunk carries many VLANs, tagged. Membership is a
matter of tags, not addresses: traffic between VLANs goes through a router, which is where rules between them are
set.
How VLANs work, step by step
A plain switch makes every port one broadcast domain: an ARP request from one device reaches all the others. A VLAN splits one switch, or a building of switches, into several separate networks. The mechanism is a tag of 4 bytes, defined by IEEE 802.1Q, inserted into the Ethernet frame right after the two MAC addresses:
| Field | Size | Meaning |
|---|---|---|
| TPID | 16 bits | 0x8100, in the place where the EtherType normally sits: "a tag follows" |
| PCP | 3 bits | priority, 0 to 7, used by QoS (802.1p) |
| DEI | 1 bit | drop eligible under congestion |
| VID | 12 bits | the VLAN ID, 1 to 4094 (0 and 4095 are reserved) |
The real EtherType (0x0800 for IPv4, 0x0806 for ARP) follows the tag. Here is what happens to one frame:
- A PC sends an ordinary, untagged frame. Its switch port is an access port in VLAN 10.
- The switch tags it internally with VLAN 10 and learns the source MAC in VLAN 10's table.
- It forwards only to ports in VLAN 10. A broadcast floods to VLAN 10's ports and no others.
- On a trunk, a link between switches or to a router, the frame leaves tagged, so the next switch knows which VLAN it belongs to. One VLAN per trunk may go untagged: the native VLAN.
- At the far access port the tag is removed, and the receiving PC never sees it.
Traffic between VLANs needs a router, like traffic between any two networks. That can be a router with one VLAN card per VLAN on a single trunk (a router on a stick), or a layer 3 switch with an interface in each VLAN. Either way, the router is where rules between departments go.
What it looks like on a Linux machine
Linux makes a VLAN card on top of a physical one. In the VLANs lab alice's address lives on
eth0.10, and what she sends through it leaves eth0 tagged:
$ ip link add link eth0 name eth0.10 type vlan id 10
$ ip -d link show eth0.10
4: eth0.10@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
vlan protocol 802.1Q id 10 <REORDER_HDR>
A capture on the cable shows the tag. tcpdump -e prints the link layer:
$ tcpdump -e -nn -i eth0 icmp
9e:3b:52:c1:07:4a > d2:65:0f:8e:21:b3, ethertype 802.1Q (0x8100), length 102: vlan 10, p 0, ethertype IPv4 (0x0800), 10.0.10.10 > 10.0.10.11: ICMP echo request, id 7, seq 1, length 64
Length 102 is the usual 98-byte ping frame plus the 4-byte tag. A Linux bridge with VLAN filtering acts as a
VLAN-aware switch, and bridge vlan show is its show vlan. An access port reads 10 PVID Egress Untagged:
untagged frames coming in join VLAN 10, and VLAN 10 leaves untagged. A trunk port lists several VLANs without those
flags. The VLAN trunks lab builds two switches joined by one.
What goes wrong, and how you see it
The right address in the wrong VLAN. A device with a sales address on an engineering port gets no ARP
answers: its neighbour entry stays INCOMPLETE, then FAILED. Membership is a matter of tags, not addresses,
and the lab proves it by moving one address between VLAN cards.
A VLAN missing from a trunk. Devices on the same VLAN, cabled to different switches, cannot reach each other, while everything else works. Check the allowed VLANs on both ends of the trunk.
Native VLAN mismatch. Each end sends untagged frames for a different VLAN, so traffic leaks from one VLAN into another. Nothing on a plain Linux bridge warns you; the safe habit is a native VLAN that no device uses.
MTU surprises. The tag adds 4 bytes. Gear that cannot take a 1522-byte frame drops full-size packets, and only large transfers fail.
VLAN hopping. An attacker on the native VLAN sends a frame with two tags. The first switch strips the outer one and the inner one carries the frame into another VLAN, one way. Keeping access ports out of the native VLAN stops it.
Questions people ask
What is the difference between an access port and a trunk port? An access port belongs to one VLAN and carries untagged frames, for an end device. A trunk carries many VLANs, tagged, between switches, routers and hypervisors.
How many VLANs can there be? 4094 usable IDs in 12 bits. Data centres that need more use VXLAN, which carries a 24-bit network id over UDP.
Is a VLAN a subnet? Not by definition, but in practice one VLAN carries one IP subnet, and the router between VLANs routes between those subnets.