The idea
A physical LAN is fixed by wiring — which stations share a broadcast domain is decided by which cables run where. A VLAN breaks that link. It is a LAN configured by software, not by wiring, so one physical switch can host several logically separate networks, and two ports on the same switch can belong to entirely different broadcast domains without a single cable changing.
Grouping and links
How it works
How VLANs are built
Stations are grouped into a VLAN by VLAN number, IP address, MAC address, or some combination of these — the switch decides which broadcast domain a frame belongs to based on whichever rule it is configured with, not based on which physical cable the frame arrived on.
Two kinds of link matter once more than one switch is involved:
- Access links connect to end devices — a PC, a printer — and carry traffic for exactly one VLAN. The device on the other end has no idea VLANs exist.
- Trunk links connect switches to each other and carry traffic for multiple VLANs over a single physical link. This is called trunking.
Trunking needs a way to tell frames from different VLANs apart once they share one wire. That is what the tag does.
Aside
The lecture does not give the tag format
Lecture 4 covers VLANs conceptually — grouping, broadcast domains, trunk and access links — but its own diagram is an unexpanded placeholder with no field breakdown. What follows is the standard IEEE 802.1Q tag format, confirmed against the tag structure and frame-size figures.
Before — untagged Ethernet frame
After — 802.1Q tag inserted between source address and type/length
The 4-byte tag itself
The tag is 4 bytes, inserted between the source address and the type/length field, not appended to the end. That placement matters: a device that does not understand VLANs still finds the type/length field exactly where it expects, one field earlier than it sits in a tagged frame, so an untagged-only device simply never looks in the right place to notice the tag exists.
Inside those 4 bytes:
- TPID (16 bits) — fixed at
0x8100, the value that tells a VLAN-aware device “this is a tag, not the type field”. - PCP (3 bits) — priority code point, for traffic prioritisation.
- DEI (1 bit) — drop eligible indicator.
- VLAN ID (12 bits) — the actual VLAN number, giving up to
4096possible values.
Because the tag adds 4 bytes to every frame that carries it, the maximum Ethernet frame size grows from the usual 1518 bytes to 1522 bytes on a tagged link.
Check yourself
An untagged frame is 64 bytes. The same frame goes out over a trunk link with an 802.1Q tag added. How big is it now?
68 bytes. The tag is a flat 4-byte insertion regardless of the frame’s original size, which is exactly why the maximum frame size grows from 1518 to 1522 bytes rather than to some other number.
| Physical LAN | VLAN | |
|---|---|---|
| Determined by | Wiring | Switch configuration (software) |
| Changing membership | Re-run cable | Reconfigure the switch |
| Broadcast domain | One per physical segment | One per VLAN, independent of wiring |
| Access link | Trunk link | |
|---|---|---|
| Connects to | An end device | Another switch |
| Carries | One VLAN | Multiple VLANs, tagged |
| Does the end device see the tag? | No | N/A — this link runs between switches |
In the exam
- A VLAN is software-defined, not wiring-defined. State this as the core distinction if asked what a VLAN is.
- Access links carry one VLAN; trunk links carry many, tagged. Get the direction right — trunk links run switch to switch, not switch to device.
- The 802.1Q tag is 4 bytes, inserted between the source address and type/length, not appended.
- Maximum frame size: 1518 → 1522 bytes once a tag is present. This is the number most likely to appear as a one-mark question.
- TPID is fixed at
0x8100. That is how a switch recognises a tag rather than an ordinary type field. - None of the tag format is in Lecture 4’s own slides. If a question tests it, it is testing whether you know the standard, not whether you remembered the lecture.