Take the 2-minute tour ×
Network Engineering Stack Exchange is a question and answer site for network engineers. It's 100% free, no registration required.

I hear about VLAN tagging, but I don’t quite understand the concept. I know a trunk cannot accept untagged packets without configuring a native VLAN, and that access ports only accept untagged packets. But I don’t understand why packets need to be tagged or untagged. What purpose does it serve?

share|improve this question
I looked at your old questions, and discovered that you haven't accepted any answers. Please consider accepting the answer that was most useful by clicking the grey check box to the left of the answer. –  Mike Pennington Mar 24 at 8:08

3 Answers 3

up vote 17 down vote accepted

If you have more than one VLAN on a port (a "trunk port"), you need some way to tell which packet belongs to which VLAN on the other end. To do this you are "tagging" a packet with a VLAN tag (or VLAN header if you like). In reality a VLAN tag is inserted in the Ethernet frame like this:

VLAN Header

The 802.1Q (dot1q, VLAN) tag contains a VLAN-ID and other things explained in the 802.1Q Standard. The first 16 bits contain the "Tag Protocol Identifier" (TPID) which is 8100. This also doubles as the EtherType 0x8100 for devices that don't understand VLANs.

So a "tagged" packet contains the VLAN information in the Ethernet frame while an "untagged" packet doesn't. A typical use case would be if you have one port from a router to a switch which multiple customers are attached to:

VLAN Trunking

In this example customer "Green" has VLAN 10 and Customer "Blue" has VLAN 20. The ports between switch and customers are "untagged" meaning for the customer the arriving packet is just a normal Ethernet packet.

The port between router and switch is configured as a trunk port so that both router and switch know which packet belongs to which customer VLAN. On that port the Ethernet frames are tagged with the 802.1Q tag.

share|improve this answer

The defacto VLAN encapsulation protocol is 802.1Q (dot1.q). Its most basic function is to retain VLANs across switches. Since VLANs are locally significant to the switch, you have to tag a frame going to near-by switches to let them know what logical grouping that frame belongs to.

share|improve this answer

By default the Native VLAN is the default VLAN, a trunk port can carry multiple VLANs to route traffic to the router or a switch. VLAN is a layer 2 protocol and it segments a layer 2 network, they can only communicate in a Layer 3 device such as a router or a layer 3 switch.

Native VLAN is used so untagged frames can communicate without the need of a router. It is best security practice to change default/native VLAN to another VLAN using this command: switchport trunk native vlan .

Cisco switches supports IEEE 802.1Q encapsulation, and ISL.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.