What Is a VLAN?
Table of Contents
What a VLAN Is
A VLAN (Virtual Local Area Network) is a logical grouping of devices that behave as if they are on the same physical network segment, regardless of where they are physically connected. Two devices on the same VLAN can communicate at Layer 2. Two devices on different VLANs cannot communicate without a router, even if they are plugged into the same physical switch.
Without VLANs, every device plugged into a switch is in the same broadcast domain. A broadcast from any device reaches every other device on that switch (and any switches connected to it). VLANs partition the switch into multiple independent broadcast domains.
Why VLANs Exist
VLANs solve several problems simultaneously:
- Broadcast containment - broadcasts (ARP, DHCP, NetBIOS) stay within their VLAN. A network with 1,000 devices on one flat segment generates enormous broadcast traffic. Splitting into 10 VLANs of 100 devices each reduces broadcast load by 90% for each device.
- Security segmentation - devices on different VLANs are isolated at Layer 2. An IoT camera on VLAN 20 cannot directly reach a finance server on VLAN 10 without passing through a router/firewall where access policies can be enforced.
- Organizational flexibility - departments can be on the same VLAN regardless of physical location. The marketing team on floor 3 and floor 7 can share a VLAN without running a cable between floors.
- Reduced attack surface - a compromised device on one VLAN cannot easily scan or attack devices on other VLANs. Lateral movement is constrained to the VLAN boundary.
How VLANs Work: 802.1Q Tagging
IEEE 802.1Q is the standard that defines VLAN tagging. When a frame needs to cross a link that carries multiple VLANs (a trunk link), the switch inserts a 4-byte tag into the Ethernet frame header. This tag contains:
- TPID (Tag Protocol Identifier) - 2 bytes, always 0x8100, indicating this is an 802.1Q tagged frame
- PCP (Priority Code Point) - 3 bits, used for Quality of Service priority
- DEI (Drop Eligible Indicator) - 1 bit, indicates whether the frame can be dropped during congestion
- VID (VLAN Identifier) - 12 bits, the VLAN number (0-4095, with 0 and 4095 reserved)
The 12-bit VID field allows up to 4,094 VLANs on a single switch infrastructure. Each VLAN is identified by its number. VLAN 1 is typically the default (untagged) VLAN. Common conventions include VLAN 10 for management, VLAN 20 for servers, VLAN 30 for workstations, VLAN 40 for IoT/guest - but the numbering is arbitrary.
Access Ports vs Trunk Ports
Switch ports operate in one of two modes:
Access port - assigned to a single VLAN. The connected device sends and receives normal (untagged) Ethernet frames. The switch internally associates all traffic on that port with the configured VLAN. The end device does not know it is on a VLAN - the tagging is invisible to it.
Trunk port - carries traffic for multiple VLANs simultaneously. Frames on a trunk link include the 802.1Q tag so the receiving switch knows which VLAN each frame belongs to. Trunk links connect switches to other switches, routers, and virtualization hosts that need access to multiple VLANs.
The "native VLAN" on a trunk is a special case: frames belonging to the native VLAN are sent untagged on the trunk. This maintains backward compatibility with devices that do not understand 802.1Q tags. The default native VLAN is usually VLAN 1.
graph TD
subgraph "VLAN 10: Workstations"
W1["Laptop A"]
W2["Laptop B"]
end
subgraph "VLAN 20: Servers"
S1["File Server"]
S2["Database"]
end
subgraph "VLAN 30: IoT"
I1["Camera"]
I2["Thermostat"]
end
VLAN10 --- FW["Firewall / Router"]
VLAN20 --- FW
VLAN30 --- FW
FW -->|"Rules control
inter-VLAN traffic"| FW
VLANs and Security
VLANs are a Layer 2 segmentation mechanism, not a security boundary by themselves. To enforce security between VLANs, you need a router or Layer 3 switch with access control lists (ACLs) or a firewall between VLANs.
A common deployment pattern for IoT security:
- VLAN 10: corporate workstations (full network access)
- VLAN 20: servers (restricted inbound access)
- VLAN 30: IoT devices (cameras, sensors, printers - internet access only, no access to VLAN 10 or 20)
- VLAN 40: guest WiFi (internet access only, completely isolated from all other VLANs)
Without VLANs, a compromised smart thermostat on the same flat network as the finance server has a direct path to attack it. With proper VLAN segmentation and inter-VLAN firewall rules, the thermostat can reach the internet for updates but cannot reach the finance server at all.
VLAN Attacks
VLANs can be attacked when misconfigured:
VLAN hopping (switch spoofing) - an attacker configures their device to act as a switch and negotiates a trunk link with the real switch using DTP (Dynamic Trunking Protocol). Once a trunk is established, the attacker can send tagged frames to any VLAN. Defense: disable DTP on all access ports and explicitly configure port modes.
Double tagging - the attacker sends a frame with two 802.1Q tags. The first switch strips the outer tag (matching the native VLAN) and forwards the frame with the inner tag, which belongs to a different VLAN. This only works in one direction and requires the native VLAN of the trunk to match the attacker's access VLAN. Defense: use a dedicated native VLAN that no access port uses, or tag the native VLAN explicitly.
ARP spoofing within a VLAN - VLANs do not prevent ARP spoofing within the same VLAN. All devices on VLAN 10 can still ARP spoof each other. Dynamic ARP Inspection is needed for intra-VLAN ARP security.
Practical Segmentation
VLAN segmentation is one of the most effective and underused security controls in small and medium networks. Many organizations run flat networks where every device - workstation, printer, camera, guest phone - shares the same Layer 2 segment.
When the BLEShark Nano scans a WiFi network, the devices it discovers are all on the same Layer 2 segment (the wireless VLAN). If that VLAN is the same one as the corporate servers, every wireless client has Layer 2 adjacency with those servers. Proper VLAN design places wireless clients on a separate VLAN with controlled access to server resources.
Understanding VLANs is essential for evaluating whether a network's segmentation actually provides the isolation it claims. During a wireless assessment, one of the first questions is: "What can a device on this WiFi network reach?" The answer depends entirely on the VLAN configuration.