VLAN

VLAN (Virtual Local Area Network) is a way to split one physical network into several separate logical networks. The split happens at Layer 2 of the OSI model — at the level of switches, not cables. Devices in different VLANs are kept apart: they cannot “see” each other directly or exchange traffic without a router or a Layer 3 switch. It is a bit like dividing one open-plan office into separate rooms with partitions — everyone is still in the same building, but each team gets its own space. The standard that lets Ethernet frames be tagged with a VLAN number is IEEE 802.1Q.

How does a VLAN work?

An ordinary switch without VLANs forms one shared broadcast domain. That means a broadcast frame sent by any host reaches every other port. A VLAN splits that switch into several independent domains, as if one device held several separate switches inside it.

Assigning a port to a VLAN is a setting in the configuration, not a physical connection. To move a computer to a different VLAN you do not re-cable anything — you just change the setting. For VLANs to work across several switches at once, the traffic between them has to carry information about which VLAN it belongs to. That is exactly what the frame tagging in 802.1Q handles.

Frame tagging (802.1Q)

The 802.1Q standard adds a 4-byte tag to the Ethernet frame. It sits right after the source and destination MAC addresses and before the EtherType field. The tag has four parts:

• TPID (Tag Protocol Identifier) — 16 bits set to 0x8100. It simply says: “this frame is 802.1Q-tagged.”
• PCP (Priority Code Point) — 3 priority bits per 802.1p (Quality of Service, QoS). They give 8 levels of traffic importance.
• DEI (Drop Eligible Indicator) — 1 bit. It marks a frame that can be dropped first when the network is congested (formerly called CFI).
• VID (VLAN Identifier) — 12 bits of VLAN number. The range is 0–4095: 0 means no VLAN (priority only), 4095 is reserved, so in practice you use 1–4094.

Adding the tag grows the maximum frame from 1518 to 1522 bytes.

Access and trunk ports

• An access port belongs to a single VLAN and carries untagged traffic. Single end devices connect to it: a computer, a printer, an IP camera.
• A trunk port carries traffic for many VLANs at once — between switches or to a router or firewall. Here frames get 802.1Q tags so it is clear which VLAN they belong to.
• The native VLAN is the exception: its traffic crosses a trunk without a tag. Traffic that arrives on a trunk untagged is assigned to the native VLAN. This matters quite a lot for security (see double tagging).

What is inter-VLAN routing?

VLANs are separate Layer 2 networks, and usually separate IP subnets too. So communication between them needs a Layer 3 device. This is done in two ways:

• router-on-a-stick — one physical router interface is split into several logical subinterfaces, one per VLAN. The router connects to the switch over a trunk.
• a Layer 3 switch with SVIs (Switched Virtual Interfaces) — faster and typical in production networks.

The point where traffic crosses between VLANs is the natural place for firewall rules and access control lists (ACLs) between segments.

How does VLAN segmentation differ from microsegmentation?

A VLAN splits the network roughly, into large zones: users, servers, IoT, guests. Within a single VLAN, devices talk to each other freely by default — control only kicks in at the boundary between VLANs, at Layer 3.

Microsegmentation goes further. It enforces rules down to a single machine or application, including inside the same segment. It is usually used in a Zero Trust approach, through host firewalls or data center fabric policy. VLANs and microsegmentation are not mutually exclusive — a VLAN often serves as the base layer on top of which finer rules are applied. The “free communication inside a VLAN” gap is also partly closed by a private VLAN (PVLAN), which isolates ports within a single VLAN (isolated, community, promiscuous ports).

Why are VLANs used?

• Smaller broadcast domains — broadcast frames and ARP requests no longer flood the whole network, which offloads and stabilizes large L2 networks.
• Segmentation and isolation — traffic of different trust levels is separated (e.g., OT/IoT devices from the office network, guests from the internal network).
• A basis for security rules — VLAN boundaries are where ACLs, firewall rules, and traffic inspection are applied.
• Flexibility — a device’s membership changes in the configuration, without touching cables.

What are the security risks of VLANs?

One thing is worth remembering: a VLAN is segmentation, not a full security boundary. Isolation based on VLANs alone can be bypassed. The most common way is the VLAN hopping family of attacks — “hopping” into traffic on a VLAN that should normally be unreachable.

Switch spoofing

The attacker pretends to be a switch and persuades a port to set up a trunk. If it works, they get access to traffic from all VLANs. The attack abuses automatic trunk negotiation — on Cisco hardware this is the DTP (Dynamic Trunking Protocol), when a port runs in dynamic auto or dynamic desirable mode. Defense: manually set end-user ports to access mode and turn off DTP and automatic trunking.

Double tagging

The attacker puts two 802.1Q tags in a frame. The first (outer) tag matches the trunk’s native VLAN, so the first switch strips it and adds no new one. The second (inner) tag stays and steers the frame to the victim VLAN on the next switch. The attack works one way only (no return traffic), but that is enough, for example, to inject traffic. Defense: make the trunk’s native VLAN different from any user VLAN — ideally a separate, unused VLAN; explicitly tagging the native VLAN also helps.

Other risks and hardening

• Do not place devices on the default VLAN 1 and do not use it as a native VLAN.
• Shut down unused ports and assign them to a separate “blind” VLAN (unused VLAN).
• Use private VLANs to isolate ports within a segment (e.g., hosting, guest networks).
• Remember that a misconfigured trunk or a shared native VLAN can leak traffic between trust zones.

Why do VLANs matter for monitoring and the SOC?

The VLAN layout is important context when detecting threats and analyzing traffic (NDR, that is Network Detection and Response; network monitoring). In practice:

• Telemetry with a VLAN number — NetFlow/IPFIX and sFlow flow records can report the VLAN identifier. This lets you attribute traffic to a segment and catch communication that should not cross zone boundaries.
• Detecting traffic between VLANs — unexpected traffic between segments that were meant to be separate signals a misconfiguration or an attacker moving across the network.
• Detecting Layer 2 anomalies — odd double-tagged frames, sudden trunk negotiation attempts (DTP), or traffic on the native VLAN can point to a VLAN hopping attempt.
• Good sensor placement — mirroring/SPAN or TAPs must cover the right VLANs and trunks. Otherwise blind spots appear: traffic inside a segment never reaches the collector.

Finally, two things that are easy to mix up. A VLAN (Layer 2, a broadcast domain) is not the same as a subnet (Layer 3, a range of IP addresses) — though they are usually mapped 1:1. And a VLAN on its own does not provide full security: without port hardening, ACLs/firewall at L3, and access control (e.g., 802.1X), its isolation can be bypassed.

Learn more

• North-South vs East-West Traffic — VLANs segment networks and shape east-west traffic within and between broadcast domains.
• Secure Access Service Edge (SASE) — VLANs can feed SASE policies by separating users, devices, and traffic at the network edge.
• BYOD (Bring Your Own Device) — VLANs help isolate BYOD devices from corporate systems and limit access to required resources.