8021Q

IEEE 802.1Q, commonly referred to as 802.1Q or VLAN tagging, is a networking standard that enables multiple virtual networks to share a single Ethernet link. By inserting a VLAN tag into Ethernet frames, switches can identify the intended VLAN and forward traffic accordingly, allowing trunk links and segregated broadcast domains within a single physical network.

Tag format: The tag is a 4-byte field inserted after the source MAC address and before the EtherType. It starts with a 2-byte Tag Protocol Identifier set to 0x8100, followed by a 2-byte Tag Control Information. The TCI carries a 3-bit Priority Code Point (PCP) for QoS, a 1-bit Drop Eligible Indicator, and a 12-bit VLAN Identifier (VID). VLAN IDs range from 1 to 4094; 0 and 4095 are reserved in many deployments.

Usage: On trunk ports, frames for multiple VLANs are tagged; on access ports, frames are untagged and associated with a single VLAN. The concept of a native VLAN maps untagged frames on a trunk to a specific VLAN. Switches learn MAC addresses per VLAN, enabling isolation of broadcast and multicast traffic.

Extensions and evolution: VLAN stacking, known as Q-in-Q, is defined by IEEE 802.1ad to nest customer VLANs inside provider VLANs. 802.1Q has been revised and incorporated into later standards (for example, 802.1Q-2014).

Impact and considerations: 802.1Q is widely implemented in Ethernet networks for segmentation and QoS. Security risks include VLAN hopping and misconfiguration; proper trunk configuration and VLAN pruning are essential.