Course contents

Chapter 4: VLANs and TrunksLesson 3 of 14

Tagged and untagged frames (802.1Q)

A PC sends a normal Ethernet frame, but the switch-to-switch cable carries VLAN 10 and VLAN 20. Where does the VLAN number appear, and why is it absent when the printer receives the frame? Let's inspect each link.

Beginner · 6 min read

How does the receiving switch keep the groups apart?

In our example a PC and printer belong to VLAN 10, separated by SW1 and SW2. Their ordinary access links carry untagged data. The trunk between the switches also carries VLAN 20, so SW2 needs to know which group each non-native data frame belongs to.

A tagged frame includes an IEEE 802.1Q field identifying its VLAN. An untagged frame has no such field on that cable. A frame can belong to VLAN 10 inside the switch without carrying a VLAN 10 tag on every link. Classification inside the switch and the bytes transmitted on the cable are different things.

Tagged and untagged describe the frame on this link

An ordinary switched data frame is classified into a VLAN, but it need not carry its VLAN number. That's the whole difference:

The explorer uses a VLAN 10 PC-to-printer path. Choose each cable and keep native VLAN 99 on both switches initially. The native VLAN is the receiving trunk's classification for ordinary untagged data when native tagging is disabled; it is not the VLAN that every device must use.

Inspect a frame on each cable

The single tag is four bytes, inserted after the source MAC address. Its TPID (Tag Protocol Identifier), normally 0x8100 for this customer VLAN tag, identifies the tag format. TCI (Tag Control Information) contains the priority, drop-eligibility and VLAN fields below. Hexadecimal is a compact way of writing bits; 0x8100 is not an IP address or application port.

  • PCP (Priority Code Point) is three bits, with values 0–7. It can help a configured quality-of-service policy classify traffic; the bits do not guarantee bandwidth by themselves.
  • DEI (Drop Eligible Indicator) is one bit used by supported congestion policies.
  • VID (VLAN Identifier) is 12 bits. Values 1–4094 identify ordinary VLANs; 0 means priority-tagged traffic without a VLAN ID assignment, and 4095 is reserved. A switch may support a smaller number of simultaneously active VLANs.
One tag adds four bytes between source MAC and Type
One tag adds four bytes between source MAC and TypeA single 802.1Q tag follows destination and source MAC addresses and precedes the original EtherType. The tag has TPID 0x8100 and TCI: PCP three bits, DEI one bit and VLAN ID twelve bits. A 1500-byte payload gives 1518 bytes untagged or 1522 bytes with one tag, including FCS but excluding preamble and SFD.Single-tag Ethernet data frameDst MACSrc MAC802.1QTypePayloadFCSTPID 0x8100 · 16 bits + TCI · 16 bitsPCP: 3 bitsDEI: 1 bitVLAN ID: 12 bitsPriority valueDrop eligibilityVLAN 10 in this example
Field widths are illustrative. The VLAN ID is not an IP address or TCP port. Tag insertion/removal changes the frame contents, so the transmitted FCS must reflect those contents. VLAN IDs 0 and 4095 have special/reserved meanings; platform VLAN support can be narrower than 1–4094.

For the journey, assume the PC already knows the printer's MAC address and the switches have learned its location. Tagging does not replace ARP (Address Resolution Protocol) or MAC learning. Those processes find the local receiver and output port; the tag preserves the VLAN context on the shared trunk.

Follow a VLAN 10 frameChoose a cable to inspect
Inspect the frame on a cable
Tagged · VLAN 10Trunk link
Dest MACSrc MAC802.1Q
VLAN 10TypePayloadFCS

VLAN 10 is not native, so its data frame carries an 802.1Q tag across the trunk.

Simplified data-frame example: access VLAN 10 at both endpoints, VLAN 10 allowed and forwarding on the trunk. Field widths are illustrative.
Inspect a frame on each cable
Inspect a frame on each cableProperty; Untagged; Tagged. VLAN ID in the frame?: No Yes, in a 4-byte 802.1Q tag How the VLAN is known: From the receiving port (its access VLAN, or the trunk's native VLAN) From the tag itself Who needs to understand it: Any Ethernet device VLAN-aware devices only (switches, routers, hypervisors, APs, firewalls) VLANs per link: One Many on the same link Frame with a 1500-byte payload, including FCS: 1518 bytes 1522 bytes with one tag Cisco port type: Access port (and the native VLAN on a trunk) Trunk port (and the voice VLAN on an access port)PropertyUntaggedTaggedVLAN ID in the frame?NoYes, in a 4-byte 802.1Q tagHow the VLAN is knownFrom the receiving port (its accessVLAN, or the trunk's native VLAN)From the tag itselfWho needs to understanditAny Ethernet deviceVLAN-aware devices only (switches,routers, hypervisors, APs, firewalls)VLANs per linkOneMany on the same linkFrame with a 1500-bytepayload, including FCS1518 bytes1522 bytes with one tagCisco port typeAccess port (and the native VLAN on atrunk)Trunk port (and the voice VLAN on anaccess port)

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Read each row across: the left box names the item, the others describe it.

Why both exist: a typical endpoint uses untagged data, while a VLAN-aware device can handle tags. Switch port configuration determines what is expected on each link; the device type alone does not decide the port mode.

Where each one is used

Where each one is used
Where each one is usedConnection; Frames on the wire; Why. PC, printer, camera → switch: Typically untagged data The endpoint is configured for one untagged access VLAN IP phone with a PC behind it: Voice tagged, PC data untagged The phone tags its own voice VLAN; the PC stays untagged Switch ↔ switch: Tagged (native VLAN untagged) Many VLANs share the link Switch ↔ router (router-on-a-stick): Tagged Each subinterface matches one VLAN tag Switch ↔ hypervisor or VLAN-aware server: Tagged VMs in different VLANs share one physical NIC Switch ↔ access point with local VLAN switching: Depends on the AP design A trunk can carry locally switched SSID VLANs; centrally tunneled WLANs have different uplink needs Switch ↔ firewall: Tagged The firewall has an interface (and policy) per VLANConnectionFrames on the wireWhyPC, printer, camera →switchTypically untagged dataThe endpoint is configured for oneuntagged access VLANIP phone with a PCbehind itVoice tagged, PC data untaggedThe phone tags its own voice VLAN;the PC stays untaggedSwitch ↔ switchTagged (native VLAN untagged)Many VLANs share the linkSwitch ↔ router(router-on-a-stick)TaggedEach subinterface matches one VLANtagSwitch ↔ hypervisor orVLAN-aware serverTaggedVMs in different VLANs share onephysical NICSwitch ↔ access pointwith local VLANswitchingDepends on the AP designA trunk can carry locally switchedSSID VLANs; centrally tunneled WLANshave different uplink needsSwitch ↔ firewallTaggedThe firewall has an interface (andpolicy) per VLAN

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Read each row across: the left box names the item, the others describe it.

Reading other vendors' VLAN settings

Some platforms describe tagged and untagged VLAN membership instead of access and trunk modes. Ingress means traffic entering a port; egress means traffic leaving it. The PVID (Port VLAN Identifier) classifies ordinary untagged incoming data. Egress membership separately determines whether that VLAN leaves tagged or untagged; setting one does not necessarily configure the other. For a conventional trunk, tagged VLANs 10 and 20 with untagged VLAN 99 and PVID 99 correspond to a Cisco trunk allowing 10,20,99 with native VLAN 99.

Checking which VLANs a port tags

The following is a read-only Cisco Catalyst IOS XE example. Administrative Mode is the configured intent; Operational Mode is the actual port role. Read both. The Access Mode VLAN field can still display VLAN 1 on a trunk; it does not mean all trunk traffic belongs to VLAN 1.

Illustrative Cisco Catalyst IOS XE output, shortened and written for this lesson
SW1#show interfaces GigabitEthernet1/0/23 switchport
Name: Gi1/0/23
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: trunk
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: dot1q
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 99 (NATIVE)
Trunking VLANs Enabled: 10,20,99
...
Trunking VLANs Enabled is the allowed list, not proof that each VLAN forwards. Compare the active and forwarding lists in show interfaces trunk. Native VLAN 99 is normally untagged; check native-tagging configuration separately, using show vlan dot1q tag native where supported or the global vlan dot1q tag native setting. A capture of the link can confirm the actual data-frame tags.

Reference: Cisco IOS XE VLAN trunking guide. Examples assume ordinary data frames with at most one tag; control traffic and priority-tagged frames need separate treatment.

Short lab: predict the bytes before changing the explorer

  1. Keep access VLAN 10 at the PC and printer, native VLAN 99 on both trunks, and native tagging off. Select PC → SW1, SW1 → SW2 and SW2 → Printer. Predict untagged, tagged 10 and untagged, then compare the result.
  2. Change the explorer's native VLAN to 10. This changes both ends together. With native tagging off, the trunk data is now untagged; the receiving switch still classifies it into VLAN 10. The access frames are unchanged.
  3. Enable native tagging in the explorer. Observe tag 10 on the trunk. This teaching control changes only the model, not a real switch. Actual native-tagging commands can be global and platform-dependent, so do not toggle them on a live network merely to reproduce the animation.
  4. For a real isolated lab, read the switchport settings at both ends and compare an authorised packet capture on the intended link. NIC offload or capture placement may hide or remove tags, so an untagged-looking host capture alone does not prove the trunk sent no tag.

Tags let many groups share a cable, but require agreement between the connected devices. They identify a VLAN, not an encrypted channel. Keeping ordinary endpoints untagged reduces endpoint configuration; the switches carry the extra responsibility.

Test yourself on tagged and untagged frames

Predict · scenario 1

A tagged frame for VLAN 10 is sent out an access port in VLAN 10 to a PC. What does the PC receive?

Predict · scenario 2

A switch port tags VLANs 10 and 20, sends VLAN 30 untagged, and assigns untagged ingress to PVID 30. With native tagging disabled, what is the conventional Cisco equivalent?

Predict · scenario 3

A hypervisor hosts VMs in VLANs 10 and 20 over one cable. How should the switch port be set?