How VLAN trunking actually works

An access port carries one VLAN. A trunk carries many, and tells them apart with a four-byte tag — except for one.

A frame arriving on an access port carries no VLAN information. The switch knows which VLAN it belongs to because of which port it came in on. That works until the frame has to reach another switch, where port numbers mean nothing.

The 802.1Q tag

On a trunk, the switch inserts four bytes after the source MAC address. Twelve of those bits carry the VLAN ID, which is why the range is 1 to 4094 — 4096 values, less 0 and 4095 which the standard reserves.

The receiving switch reads the tag, places the frame in that VLAN, and strips the tag again before the frame leaves an access port. Hosts never see it.

The native VLAN, and the exception it creates

One VLAN on each trunk is designated native, and its traffic crosses untagged. This exists for compatibility with devices that do not understand tagging.

It also creates the fault worth understanding properly. If switch 1 has native VLAN 10 and switch 2 has native VLAN 20, a frame from VLAN 10 leaves untagged, arrives with nothing to identify it, and is classified into VLAN 20.

Two broadcast domains are now joined, and neither switch logs an error. From each switch's point of view it did exactly what it was configured to do. This is the basis of one form of VLAN hopping, and it is why the standing recommendation is to set the native VLAN to an unused ID carrying no traffic at all — then an untagged frame belongs to nothing and reaches nothing.

Allowed VLAN lists

A trunk can be restricted to specific VLANs. If the two ends' lists differ, traffic in the extra VLANs is dropped in one direction only — which produces the genuinely confusing symptom of something working one way and not the other.

Frequently asked questions

What is the native VLAN for?

Compatibility with devices that do not understand 802.1Q tagging. Its traffic crosses the trunk untagged.

Why is a native VLAN mismatch dangerous?

The frame carries no tag, so the receiving switch applies its own native VLAN. Traffic silently moves between VLANs, joining two broadcast domains, and no error is logged at either end.

How many VLANs can a trunk carry?

Up to 4094. The 802.1Q tag has 12 bits for the VLAN ID, and 0 and 4095 are reserved.

Why does traffic work in only one direction?

Almost always an allowed VLAN list that differs between the ends, so the VLAN is pruned on one side only.