A VLAN cuts one physical switch into several logical ones, so that groups can be kept apart without being given separate hardware.
Words you will meet
-
Virtual local area network virtual local area network Simple Several separate LANs configured over one set of switches. Precise A VLAN-capable switch is configured so that several logical LANs share one physical infrastructure. Ports are assigned to VLANs in software, so a person moving office, or a group being reorganised, is a configuration change rather than a rewiring. Traffic between VLANs must pass through a router. introduced in ch. 6 — open in glossary — several logical LANs defined over one physical one.
-
Port-based VLAN — the switch’s ports are divided into groups by the network manager.
-
Broadcast domain broadcast domain Simple The set of ports a broadcast frame can reach, and no further. Precise The group of ports within which broadcast traffic travels. In a port-based VLAN each group of ports forms its own broadcast domain, so broadcast traffic from one port reaches only the other ports in the same VLAN. It is the layer-2 traffic isolation that Table 6.1 previously credited only to routers. introduced in ch. 6 — open in glossary — the set of ports a broadcast can reach, and no further.
-
VLAN trunking vlan trunking Simple One link carrying frames for every VLAN, each tagged. Precise A trunk port belonging to all VLANs carries frames between VLAN switches, with an 802.1Q tag added to each frame to say which VLAN it belongs to. The tag is a 4-byte field inserted into the Ethernet header, and the CRC is recomputed. introduced in ch. 6 — open in glossary — one link carrying frames for every VLAN between two switches.
-
802.1Q — the extended Ethernet frame that says which VLAN a frame belongs to.
Why this matters
Section 6.4.3 ended with a choice between switches and routers. This section shows that the choice was never quite that clean.
Traffic isolation was the routers’ advantage. VLANs get it at layer 2, with no IP (Internet Protocol) Internet Protocol The network-layer protocol that defines the datagram format and addressing every Internet device must use. introduced in ch. 1 configuration and no cable-moving — and then need a router again the moment two VLANs must talk.
The whole section is one idea applied twice: if the hardware cannot be divided, divide it in software instead.
Three problems with a switch hierarchy
| The difficulty | What a VLAN does |
|---|---|
Cells marked ⓘ have an explanation — click to read it.
The three difficulties the book lists with the hierarchical switched LAN of Figure 6.15, and what a port-based VLAN does about each.
The third is the one that costs real time. Someone changes department, and the physical cabling has to change so they reach a different switch. Somebody who belongs to two groups is worse.
One switch, two VLANs
A switch that supports VLAN (Virtual Local Area Network) Virtual Local Area Network Several logical LANs configured over one physical switched infrastructure, so that broadcast traffic and group membership are decided by configuration rather than by cabling. introduced in ch. 6 s lets several virtual LANs be defined over a single physical infrastructure. Hosts within a VLAN communicate with each other as if they, and no other hosts, were connected to the switch.
Ports 2 to 8 belong to the Electrical Engineering VLAN. Ports 9 to 15 belong to the Computer Science VLAN. Ports 1 and 16 are unassigned. Nothing physical changed — the division exists only in the switch’s software.
Ports drawn in two rows of eight, as the book draws them. Grey is unassigned. The last step is the one the book calls "a new difficulty" — isolation is the feature and the problem at once.
Read all steps as text
- Sixteen ports, divided by the network manager — Ports 2 to 8 belong to the Electrical Engineering VLAN. Ports 9 to 15 belong to the Computer Science VLAN. Ports 1 and 16 are unassigned. Nothing physical changed — the division exists only in the switch’s software.
- Each VLAN is its own broadcast domain — Broadcast traffic from a port can only reach the other ports in its own group. A host on port 4 talks to hosts on ports 2 to 8 as though nothing else were plugged into the switch at all.
- Moving somebody is a software change — If the user on port 8 joins Computer Science, the operator reconfigures the VLAN software so that port 8 now belongs to the CS VLAN. Nobody unplugs anything and nobody moves a cable.
- But now the two cannot talk to each other — Complete isolation creates a new problem. The fix is to give a port to a router — or, in practice, to buy a single box that is both a VLAN switch and a router. A datagram from EE then crosses the EE VLAN to the router and comes back over the CS VLAN.
The switch keeps a table of port-to-VLAN mappings, and its hardware delivers frames only between ports in the same VLAN. Undeclared ports fall into a default VLAN.
In plain words
Nothing physical distinguishes port 8 from port 9. The wire is the same, the switch is the same, the frames are the same.
The difference is a line in a table. That is the whole of the idea, and it is why moving somebody between departments stops being a job for a person with a ladder.
The last step above is the difficulty the book raises immediately after solving the first three: complete isolation means EE cannot reach CS at all. One answer is to give a port to an external router belonging to both VLANs, so the logical picture looks like two switches joined by a router. In practice, vendors sell a single box that is both.
Two switches: the cable problem
Now put some EE and CS people in another building, with a second switch.
Define a port in the CS VLAN on each switch and cable them together, then do the same for EE. It works, and it does not scale: N VLANs would need N ports on each switch just to join the two switches.
The book’s Figure 6.26. In (b) the right-hand switch splits its eight ports oddly — EE on 2, 3 and 6, CS on 4, 5 and 7 — which is the point: a VLAN is a list of port numbers, not a contiguous block.
Read all steps as text
- (a) One cable per VLAN — Define a port in the CS VLAN on each switch and cable them together, then do the same for EE. It works, and it does not scale: N VLANs would need N ports on each switch just to join the two switches.
- (b) One trunk link for all of them — A special trunk port on each switch — port 16 on the left, port 1 on the right — belongs to every VLAN. Frames for any VLAN cross the single trunk link. One cable, however many VLANs there are.
- Which raises one more question — A frame arriving on a trunk port could belong to any VLAN, and an ordinary Ethernet frame carries nothing that says which. Something has to be added to the frame — and that is what 802.1Q is for.
One cable per VLAN works and does not scale. VLAN trunking replaces them with one link: a trunk port on each switch belongs to every VLAN, and all frames cross it.
Which leaves the question the last step asks. A frame arriving on a trunk port could belong to any VLAN, and a standard Ethernet header says nothing about which.
The 802.1Q tag
The IEEE (Institute of Electrical and Electronics Engineers) Institute of Electrical and Electronics Engineers The body whose 802 committee standardises Ethernet and WiFi. introduced in ch. 1 answer is an extended frame format. Four bytes are inserted into the header, carrying the identity of the VLAN the frame belongs to.
Click any box to read what that part of the message is for.
Every field, as text
- Tag Protocol Identifier — 16 bits — marks this frame as carrying a VLAN tag (example: 81-00)
- Priority — 3 bits — how urgent this frame is (example: 0)
- (unnamed) — 1 bits — the book does not name this bit (example: —)
- VLAN identifier — 12 bits — which VLAN this frame belongs to (example: 0x00A)
Inserted between the source address and the type field, by the switch at the sending end of a trunk, and removed by the switch at the receiving end. Click any field. Drawn 16 bits per row.
The tag is added by the switch at the sending end of the trunk, and parsed and removed by the switch at the receiving end. Hosts never see it. An 802.1Q frame exists only while crossing a trunk link.
The frame check has to be recomputed — and the book only says so in a figure
Adding four bytes to a frame changes its contents. The CRC (Cyclic Redundancy Check) Cyclic Redundancy Check The error-detection code used in link-layer adapters. Sender and receiver agree on a generator G; the sender appends bits so the whole pattern divides by G with no remainder under modulo-2 arithmetic. introduced in ch. 6 from section 6.2 was computed over the untagged frame, so it is no longer correct.
Figure 6.27 shows this, in the only place it appears. The top frame ends with CRC; the tagged frame below it ends with CRC′, with an annotation underneath. The prose never mentions it at all.
So a reader working from the text alone would not learn that the check has to be redone at every trunk hop. It happens twice, since the receiving switch strips the tag and must recompute it again.
The annotation itself is misprinted. It reads “Recomputed CRT”, not CRC.
Everyday picture
An open-plan office with no interior walls. Management wants two departments who do not overhear each other, and does not want to build anything.
So instead of walls, everybody gets a badge colour, and the rules say you may only speak to your own colour. The room is unchanged. Moving somebody between departments means handing them a different badge.
Where the picture stops. People could simply ignore the badges. Here the switch hardware enforces it: a frame is not permitted to leave its VLAN, so isolation is not a convention but a property of the equipment. And the tag is more like a badge worn only in the corridor between two buildings — it goes on at one door and comes off at the other.
Check yourself
Check yourself
0 of 7 answered1.An employee on port 8 moves from Electrical Engineering to Computer Science. What has to happen?
2.The two VLANs on a switch are completely isolated. How does a host in EE reach a host in CS?
3.predictTwo VLAN switches must be joined, and the network has 10 VLANs. What does the non-trunked solution cost?
4.What is in the four-byte 802.1Q tag?
5.predictA tagged frame crosses a trunk and reaches the far switch. What does the host on the far side receive?
6.predictFour bytes are inserted into a frame at a trunk. What else must change, and where does the book say so?
7.Table 6.1 gave routers the advantage on traffic isolation. What do VLANs change about that?
What to remember
- A port-based VLAN divides one switch’s ports into groups, each a broadcast domain. The division is software, so moving somebody between VLANs is a configuration change, never a cable change.
- VLANs give traffic isolation at layer 2 — the thing routers were needed for in Table 6.1. Complete isolation means the VLANs cannot talk to each other, so a router is needed after all.
- Trunking joins two VLAN switches with one link instead of one cable per VLAN. 802.1Q adds four bytes carrying a 12-bit VLAN identifier; the tag is added entering a trunk and removed leaving it, so hosts never see it.