802.1Q
VLAN tagging802.1Q is a label that keeps networks apart. It inserts a four-byte tag into the Ethernet frame, naming which VLAN the frame belongs to, so one physical link can carry many isolated networks without their traffic ever mixing.
802.1Q tags a frame with its VLAN — so one cable carries many networks that still cannot see each other.
How it works
A switch reads the VLAN ID and will only forward the frame out of ports that belong to that VLAN. The PCP field carries priority, which is how voice traffic gets ahead of a file copy.
What 802.1Q does, step by step
An access port is configured for one VLAN; anything arriving on it belongs to that network.
When the frame leaves for another switch, the switch inserts the 802.1Q tag naming its VLAN.
The receiving switch reads the tag and considers only the ports in that VLAN — the rest never see it.
Delivering to an access port, the tag is removed again; the host never knows it was there.
In cybersecurity
VLANs are the standard way to segment a LAN — but the separation is a switch configuration, and a misconfigured trunk undoes all of it.
Double-tagging exploits the native VLAN to send a frame into a VLAN the attacker isn’t in.
A host that negotiates a trunk gets every VLAN at once — disable dynamic trunking on access ports.
Allow only the VLANs a link actually needs, rather than all 4094 by default.
Give the native VLAN an ID that carries nothing, so a stray untagged frame lands nowhere.
VLANs separate broadcast domains; what may cross between them is an ACL’s job.
Guests, cameras and payment systems on their own VLANs shrink what one breach reaches.