Virtual LANs (VLANs)

Understanding VLANs conceptually is essential, but truly mastering VLANs requires understanding IEEE 802.1Q—the protocol standard that defines exactly how VLAN information is encoded and transported within Ethernet frames.

802.1Q is what transforms the abstract concept of "virtual LANs" into a concrete, interoperable reality. When a tagged frame arrives at a switch, it's the 802.1Q header that tells the switch: "This frame belongs to VLAN 30, and its priority is level 5." Without this standardized mechanism, multi-vendor VLAN deployments would be impossible.

This page dissects 802.1Q in complete detail—the frame format, the tag structure, the processing rules, and the nuances that network engineers must understand to troubleshoot and optimize VLAN-based networks.

Historical Context:

Before IEEE standardization, VLAN implementations were proprietary. Cisco developed ISL (Inter-Switch Link) in 1998, which encapsulated the entire Ethernet frame with additional headers. Other vendors had incompatible solutions. Networks composed of switches from different manufacturers couldn't share VLAN information.

The IEEE 802.1Q standard, formally titled "IEEE Standard for Local and Metropolitan Area Networks—Bridges and Bridged Networks," was published in 1998 to address this fragmentation. It defined:

• A standard method for VLAN tagging (the 802.1Q tag)
• Priority levels for Quality of Service (802.1p, incorporated into 802.1Q)
• Rules for handling tagged and untagged frames
• Native VLAN concept for backward compatibility

Standard Revisions:

The 802.1Q standard has been revised multiple times:

Standard Scope:

802.1Q covers far more than just VLAN tagging:

• VLANs and VLAN tagging
• Spanning Tree Protocol variants (STP, RSTP, MSTP)
• Generic Attribute Registration Protocol (GARP) and its successors
• Quality of Service (priority tagging)
• Multiple Registration Protocol (MRP)
• Time-Sensitive Networking (TSN) extensions

For this page, we focus on the VLAN tagging aspects—the core functionality that enables virtual LAN operation.

The 802.1Q standard defines how VLAN tags are inserted into Ethernet frames. Understanding this format is fundamental to troubleshooting and analysis.

Standard Ethernet Frame (Untagged):

A traditional Ethernet II frame without VLAN tagging:

| Preamble | SFD | Dest MAC | Src MAC | EtherType | Payload | FCS |
|   7B     | 1B  |   6B     |   6B    |    2B     | 46-1500B| 4B  |

Total frame size: 64-1518 bytes (excluding preamble and SFD)

802.1Q Tagged Frame:

The 802.1Q tag (4 bytes) is inserted between the Source MAC and the original EtherType:

| Preamble | SFD | Dest MAC | Src MAC | 802.1Q Tag | EtherType | Payload | FCS |
|   7B     | 1B  |   6B     |   6B    |     4B     |    2B     | 46-1500B| 4B  |

Total frame size: 64-1522 bytes (4 bytes larger due to tag)

Important: Frame Size Implications

The 4-byte tag increases maximum frame size from 1518 to 1522 bytes. This has implications:

FCS Recalculation:

The Frame Check Sequence (FCS) is a CRC-32 checksum covering the entire frame except preamble, SFD, and FCS itself. When a switch:

1. Adds a tag (frame entering trunk): FCS must be recalculated
2. Removes a tag (frame exiting access port): FCS must be recalculated

This recalculation is performed by switch hardware at wire speed and is transparent to end devices. However, it explains why tagged frames coming from a trunk have different FCS values than the original untagged frame—a consideration for certain packet capture scenarios.

The 4-byte (32-bit) 802.1Q tag contains several fields, each serving a specific purpose.

Tag Components:

|   TPID (16 bits)   |   TCI (16 bits)   |
|       0x8100       | PCP|DEI|  VID     |
|                    | 3b | 1b|  12b     |

1. TPID (Tag Protocol Identifier) - 16 bits:

The TPID identifies the frame as 802.1Q-tagged. Its value is 0x8100 (decimal 33024). When a switch sees 0x8100 in the position normally occupied by EtherType, it recognizes this as a VLAN-tagged frame and knows the next 16 bits are TCI (Tag Control Information).

Position: Bytes 13-14 (immediately after Source MAC)
Value: 0x8100 (for 802.1Q)
Purpose: Identifies presence of VLAN tag

Note on other TPIDs:

• 0x8100 — Standard 802.1Q
• 0x88A8 — 802.1Q-in-Q (Service VLAN, Q-in-Q tunneling)
• 0x9100 — Some vendors' proprietary Q-in-Q implementation

2. PCP (Priority Code Point) - 3 bits:

Formerly known as 802.1p priority or CoS (Class of Service), PCP provides 8 priority levels (0-7):

PCP and QoS:

PCP values enable differentiated handling within switches:

• Switches place different PCP traffic into different queues
• Higher priority traffic is serviced during congestion before lower priority
• Voice (PCP 5) and video (PCP 4) get priority over data (PCP 0)
• PCP is a Layer 2 marking; it's translated to DSCP (Layer 3) at routed boundaries

3. DEI (Drop Eligible Indicator) - 1 bit:

Formerly CFI (Canonical Format Indicator), this bit indicates frames that can be dropped during congestion:

• DEI = 0: Frame should not be dropped if avoidable
• DEI = 1: Frame eligible for early discard during congestion

This enables switches to selectively drop less important traffic within the same priority class.

4. VID (VLAN Identifier) - 12 bits:

The VID identifies which VLAN the frame belongs to. With 12 bits:

• 2^12 = 4,096 possible values (0-4095)
• VID 0: Priority tagging only (frame has no VLAN membership)
• VID 1: Default VLAN
• VID 2-4094: User-configurable VLANs
• VID 4095: Reserved (implementation-specific)

Bit layout of 12-bit VID:
|  11  |  10  |  9  |  8  |  7  |  6  |  5  |  4  |  3  |  2  |  1  |  0  |
| MSB  |      |     |     |     |     |     |     |     |     |     | LSB |

Switches follow precise rules for processing 802.1Q tags based on port mode and frame characteristics.

Access Port Processing:

Ingress (frame arriving at access port):

1. Frame arrives untagged (normal case)
2. Switch assigns frame to port's configured access VLAN
3. Frame is processed within that VLAN's context

If tagged frame arrives:

• Most switches drop tagged frames on access ports (security)
• Some can be configured to accept tagged frames (e.g., voice VLAN)

Egress (frame leaving access port):

1. Frame belongs to access port's VLAN
2. Switch removes any VLAN tag
3. Frame transmitted untagged
4. FCS recalculated

Trunk Port Processing:

Ingress (frame arriving at trunk port):

If frame is tagged:

1. Extract VLAN ID from 802.1Q tag
2. Check if VLAN is allowed on this trunk
3. If allowed: process frame in that VLAN's context
4. If not allowed: drop frame

If frame is untagged:

1. Assign frame to trunk's native VLAN
2. Process in native VLAN's context

Egress (frame leaving trunk port):

If frame belongs to native VLAN:

1. Remove 802.1Q tag (if present)
2. Transmit frame untagged
3. Recalculate FCS

If frame belongs to other VLAN:

1. Add 802.1Q tag with VID
2. Place in appropriate queue based on PCP
3. Transmit frame tagged
4. Recalculate FCS

The Native VLAN Decision Tree:

Frame arrives on trunk port
    |
    ├── Frame has 802.1Q tag?
    |     |
    |     ├── Yes → Extract VID from tag
    |     |           |
    |     |           └── Is VID allowed on trunk?
    |     |                 ├── Yes → Process in VID's context
    |     |                 └── No → Drop frame
    |     |
    |     └── No → Assign to native VLAN
    |               └── Process in native VLAN's context

Special Case: Tagged Native VLAN:

Some configurations tag even native VLAN traffic (Cisco: vlan dot1q tag native):

• All frames leave trunk tagged, including native VLAN
• Improves security (prevents double-tagging attacks)
• Both ends must agree on this configuration
• Untagged ingress frames still assigned to native VLAN

Some network architectures require multiple VLAN tags on a single frame. IEEE 802.1ad (Provider Bridges) defines this capability, commonly called Q-in-Q or double tagging.

Use Cases for Double Tagging:

1. Service Provider Networks: Service providers deliver Layer 2 connectivity to customers (Metro Ethernet). Each customer's traffic already has VLAN tags. The provider adds their own outer tag to transit customer traffic through the provider network.

Customer A: VLAN 100, 200, 300
Customer B: VLAN 100, 200 ← Same VLANs, different customer!

Provider adds outer tag:
Customer A: S-VLAN 1001 + C-VLAN 100/200/300
Customer B: S-VLAN 1002 + C-VLAN 100/200

Now customer VLANs don't conflict—they're distinguished by the outer (Service) VLAN.

2. Large Enterprise Networks: With only 4,094 VLANs available, very large networks may exhaust VLAN space. Q-in-Q provides hierarchy (though VXLAN is more common today).

3. Data Center Interconnection: Extending VLANs between data centers over service provider networks.

Q-in-Q Frame Format:

| Dest MAC | Src MAC | Outer Tag | Inner Tag | EtherType | Payload | FCS |
|   6B     |   6B    |   4B      |   4B      |    2B     | data    | 4B  |

Outer Tag (S-Tag / Service Tag):

• TPID: 0x88A8 (identifies this as a service provider tag)
• Contains S-VID (Service VLAN ID) assigned by provider

Inner Tag (C-Tag / Customer Tag):

• TPID: 0x8100 (standard customer VLAN tag)
• Contains C-VID (Customer VLAN ID) from customer network

Frame Size Impact:

• Standard Ethernet max: 1518 bytes
• Single 802.1Q tag: 1522 bytes
• Double-tagged (Q-in-Q): 1526 bytes

Equipment in Q-in-Q deployments must be configured to handle these larger frames.

Provider Bridge Terminology:

Network engineers regularly capture and analyze VLAN-tagged traffic for troubleshooting and verification. Understanding how 802.1Q appears in packet captures is essential.

Capturing Tagged Traffic:

To see 802.1Q tags in packet captures, you must capture on a trunk link or configure port mirroring that preserves tags:

On regular access ports: Captured traffic is untagged (switch strips tags before delivery)

On trunk ports or SPAN destinations: Tags are visible if configured correctly

Wireshark Analysis:

In Wireshark, 802.1Q-tagged frames display as:

Ethernet II
    Destination: aa:bb:cc:dd:ee:ff
    Source: 11:22:33:44:55:66
    Type: 802.1Q Virtual LAN (0x8100)
802.1Q Virtual LAN
    Priority: 5 (Voice)
    DEI: 0
    ID: 100
Internet Protocol Version 4
    ... (normal IP header follows)

Wireshark Filters for VLAN Analysis:

vlan                          # Any VLAN-tagged frame
vlan.id == 100                # Specific VLAN ID
vlan.priority >= 5            # High-priority traffic
vlan.id == 100 && ip.addr == 10.10.100.5  # VLAN + IP filter
vlan.id == 0                  # Priority-tagged only (no VLAN)
frame.len > 1518              # Jumbo or tagged frames

Hex Analysis of 802.1Q Tag:

For deep analysis, understanding the raw bytes is valuable:

Byte Offset  Value       Meaning
-----------  -----       -------
0-5          dest MAC    Destination MAC address
6-11         src MAC     Source MAC address  
12-13        81 00       TPID (802.1Q identifier)
14-15        XX XX       TCI (Priority + DEI + VID)
16-17        YY YY       Original EtherType
18+          payload     Frame payload

Example TCI Analysis:

TCI bytes: 0x50 0x64

Binary: 0101 0000 0110 0100

Breakdown:
0101 0 000 0110 0100
^^^^ ^ ^^^^^^^^^^^^
 PCP DEI    VID

PCP = 010 = 2 (Excellent Effort)
DEI = 1 (Drop Eligible)
VID = 000001100100 = 100 (VLAN 100)

Verification Commands:

! Verify trunk is passing expected VLANs
Switch# show interfaces Gi0/24 trunk

! Verify VLAN tag counts (some platforms)
Switch# show interfaces Gi0/24 counters

! Check for native VLAN mismatch (CDP)
Switch# show cdp neighbors detail

! Detailed VLAN statistics
Switch# show vlan id 100

Beyond basic VLAN tagging, several advanced scenarios leverage 802.1Q capabilities.

1. Voice VLAN Implementation:

Cisco IP phones can use 802.1Q tagging in a special access port configuration:

interface GigabitEthernet0/1
  switchport mode access
  switchport access vlan 30
  switchport voice vlan 100

The phone learns the voice VLAN via CDP/LLDP and tags its traffic with VID 100. The attached PC's traffic remains untagged (assigned to VLAN 30). Technically, this port handles two VLANs, but it's not a full trunk—only specific behavior for phones.

2. Native VLAN Security Configurations:

! Option 1: Tag native VLAN traffic (globally)
vlan dot1q tag native

! This makes all frames tagged on trunks, including native VLAN
! Prevents certain VLAN-hopping attacks
! Both trunk ends must support this

! Option 2: Use an unused native VLAN
interface Gi0/24
  switchport trunk native vlan 999

! VLAN 999 has no access ports, no traffic legitimately untagged
! Any untagged traffic is suspicious by definition

3. Private VLANs (PVLAN):

Private VLANs subdivide a VLAN for isolation within shared subnets:

• Primary VLAN: The "parent" VLAN carrying the subnet
• Community VLAN: Devices can communicate with each other and promiscuous ports
• Isolated VLAN: Devices can ONLY communicate with promiscuous ports (e.g., default gateway)

802.1Q tags carry secondary VLAN information within the primary VLAN structure.

4. VLAN Translation:

Some switches can translate VLAN IDs at trunk boundaries:

! Traffic entering with VLAN 100 is processed as VLAN 200 internally
switchport vlan mapping 100 200

Use cases:

• Merging networks with overlapping VLAN schemes
• Service provider handoffs with different customer VLANs
• Lab/production isolation with identical VLAN structures

5. Selective Q-in-Q:

Service provider equipment can selectively apply outer tags:

! Only add S-tag to specific C-VLANs
switchport vlan mapping 100-199 dot1q-tunnel 1001

Customer VLANs 100-199 get encapsulated with S-VLAN 1001; others might be dropped or handled differently.

IEEE 802.1Q is the foundation that makes virtual LANs operationally possible across multi-vendor, multi-switch environments. Mastering 802.1Q means understanding not just configuration, but the precise mechanics of how frames are tagged, processed, and forwarded.