802.1Q VLANs Explained

Introduction¶

A VLAN (Virtual LAN) splits one physical switch into multiple isolated broadcast domains. 802.1Q is the standard: it inserts a 4-byte tag into the Ethernet frame carrying a 12-bit VLAN ID (1–4094).

The tag¶

[ dst MAC ][ src MAC ][ 0x8100 ][ PCP:3 | DEI:1 | VID:12 ][ ethertype ][ payload ]

• 0x8100 — the "this frame is tagged" ethertype (TPID).
• VID — 1–4094 (0 and 4095 reserved). VLAN 1 is the default on most switches.
• PCP (Priority Code Point) — 3 bits of QoS class (802.1p).
• Adding the tag makes the max frame 1522 bytes — switches must accept "baby giant" frames on trunk ports.

Port types¶

• Access port — belongs to exactly one VLAN. Frames arrive/leave untagged; the switch adds the tag on ingress, strips it on egress. This is what a normal device (a PC, a printer) connects to. The device knows nothing about VLANs.
• Trunk port — carries multiple VLANs, tagged. Between switches, or to a router / hypervisor / server that itself splits traffic by VLAN. You specify the allowed VLAN list.
• Native VLAN (trunk) — one VLAN on the trunk is carried untagged. Historically for hubs/old gear. It's a footgun (see security below); set it to an unused VLAN and tag everything.

Inter-VLAN routing¶

VLANs are isolated at L2 by design. To move traffic between them you need a router (or L3 switch): a "router on a stick" with a trunk and subinterfaces, or SVIs (switched virtual interfaces) on an L3 switch. Each VLAN = one subnet = one gateway IP.

Linux tagged interfaces¶

# create eth0.10 for VLAN 10
ip link add link eth0 name eth0.10 type vlan id 10
ip addr add 10.10.0.5/24 dev eth0.10
ip link set eth0.10 up

# with NetworkManager
nmcli con add type vlan con-name vlan10 dev eth0 id 10 \
  ip4 10.10.0.5/24 gw4 10.10.0.1

eth0 itself carries the trunk; eth0.10, eth0.20 are the per-VLAN interfaces. The switch port must be a trunk allowing VLANs 10 and 20.

For VMs/containers, a Linux bridge per VLAN attached to the tagged interface, or a VLAN-aware bridge (bridge vlan add).

Security: VLAN hopping¶

• Switch spoofing — a host negotiates a trunk via DTP (Cisco) and then sees all VLANs. Mitigation: disable DTP, hard-set access ports to access mode.
• Double tagging — a frame with two tags; the first (matching the native VLAN) is stripped by the first switch, the second delivers it into another VLAN. Mitigation: native VLAN = an unused VLAN, and tag the native VLAN (vlan dot1q tag native). Never use VLAN 1 for anything real.
• Also: don't rely on VLANs alone for strong isolation of untrusted tenants — add L3 ACLs / firewalls between segments.

Verification and troubleshooting¶

ip -d link show eth0.10           # shows "vlan protocol 802.1Q id 10"
bridge vlan show                  # VLAN-aware bridge membership
tcpdump -i eth0 -e vlan           # see tags on the trunk
cat /proc/net/vlan/config

• Tagged interface up, no traffic — the switch port is an access port, not a trunk, or the trunk's allowed-VLAN list doesn't include your VID. tcpdump -e vlan on eth0: do you see tagged frames at all?
• Works untagged on eth0 but eth0.10 is dead — the switch is delivering VLAN 10 as the native (untagged) VLAN. Either use eth0 directly for that VLAN, or fix the switch to tag it.
• Wrong MTU / large packets drop on the trunk — some old NICs/switches don't handle the 1522-byte tagged frame; check for "baby giant" support or drop MTU by 4.
• Inter-VLAN traffic fails — no router between them (that's the point of VLANs), wrong gateway, or an ACL on the L3 device.
• Broadcast storm across VLANs — a loop, or a device bridging two VLANs it shouldn't (a misconfigured hypervisor/AP). STP should catch loops; check bridge link / spanning-tree state.
• Cloud VM "VLANs don't work" — cloud virtual networks don't pass 802.1Q tags to instances; use the provider's subnets/VPCs for segmentation.

Related tools and reading¶

• On-site: Subnet Calculator.
• Related posts: VXLAN and overlay networks, nmcli: common tasks without the GUI.