Switching · VLANs and Trunking

802.1Q encapsulation

Identify the VLAN tag without confusing a tagged frame with an IP route.

Independent lab examples; selected output and frame summaries are illustrative. Port naming and command support vary by switch and software release.

Network and objective

802.1Q tag handling is illustrated on an ordinary two-switch trunk; native-tag policies can change untagged behavior.

Use two fresh lab switches: H1 on SW1 Gi1/0/1, H2 on SW2 Gi1/0/1, and Gi1/0/24 between the switches. No other production links are connected.

Physical links are solid; device roles and relevant links are labeled.

How it works

A single customer 802.1Q tag adds four bytes after the source MAC: a tag protocol identifier and tag control information. The control information contains a 3-bit priority, drop eligibility and 12-bit VLAN ID. VLAN IDs 0 and 4095 are not ordinary configurable user VLANs.

An untagged access frame can gain a tag on a trunk and lose it on a receiving access link. The VLAN context selects the forwarding table. Ordinary tagging does not route the IP packet, decrement its TTL or encrypt its payload. Added encapsulation also needs suitable frame-size support.

Configure or inspect

vlan 10
vlan 20
interface GigabitEthernet1/0/24
 switchport mode trunk
 switchport trunk allowed vlan 10,20
 switchport nonegotiate

Verify the result

Illustrative output · selected lines

Reconstructed trunk frame:
  Destination 02:00:00:00:00:12
  Source      02:00:00:00:00:11
  TPID        0x8100
  PCP         0
  DEI         0
  VID         10
  EtherType   0x0800 (IPv4)

VID 10 identifies the forwarding domain; EtherType 0x0800 identifies the inner IPv4 payload. This is an illustrative decode, not a recorded packet.

Failure and recovery

A capture may hide tags because of NIC offload or its observation point. Correlate switch trunk state and capture settings before deciding that the wire carried no tag.

Use a validated observation point and check native-VLAN/tag policy on both ends. Do not change VLAN IDs based solely on one offloaded host capture.

Key Takeaways

A basic 802.1Q tag adds four bytes.
VID and EtherType describe different things.
Ordinary user VLAN IDs exclude 0 and 4095.
Tagging is not routing or encryption.
Capture placement and offloads affect visible tags.