Skip to main content
protocols.pageprotocols.page
networking

VLAN (Virtual LAN)

A VLAN segments a physical switch into multiple isolated broadcast domains using 802.1Q tags. Devices in different VLANs cannot communicate without a router (inter-VLAN routing). VLANs provide security isolation, reduce broadcast traffic, and enable network segmentation without separate physical infrastructure.

Definition

A VLAN creates a logical broadcast domain within a physical switch fabric. Frames tagged with 802.1Q carry a 12-bit VLAN ID (1-4094) in a 4-byte tag inserted between the source MAC and EtherType fields. Untagged ports (access ports) belong to one VLAN. Tagged ports (trunk ports) carry traffic from multiple VLANs between switches. Broadcast, unknown unicast, and multicast (BUM) traffic stays within its VLAN – a broadcast storm in VLAN 10 does not affect VLAN 20. VLAN segmentation is the foundation of network security architecture: management traffic on VLAN 100, servers on VLAN 200, user workstations on VLAN 300, guest WiFi on VLAN 400. Without VLANs, all devices share one broadcast domain and can sniff each other's traffic. VLAN hopping attacks (double-tagging, switch spoofing) bypass segmentation if trunk ports are misconfigured.

Examples

  • –ip link add link eth0 name eth0.100 type vlan id 100
  • –show vlan brief (Cisco IOS)
  • –bridge vlan add vid 100 dev swp1 pvid untagged (Linux bridge)

Related Protocols

ip

Related Terms

Frame

A frame is a Layer 2 (data link) unit of data that includes a header with MAC addresses, the payload (an IP packet), and a trailer with error-checking CRC. Ethernet frames have a maximum size of 1518 bytes. Frames are addressed by MAC, not IP – they do not cross router boundaries.

ARP (Address Resolution Protocol)

ARP resolves IP addresses to MAC addresses on local networks. When a host needs to send a packet to an IP on the same subnet, it broadcasts an ARP request. The target responds with its MAC address. ARP has no authentication – ARP spoofing enables man-in-the-middle attacks on LANs.

Subnet

A subnet is a logical division of an IP network defined by a subnet mask (e.g., /24 = 255.255.255.0). Hosts within a subnet communicate directly via ARP without routing. Hosts in different subnets must send traffic through a router. Subnetting reduces broadcast domains and enables hierarchical IP allocation.