Where does the vlan tag change in the data path?

Question

Suppose we have a switch we two hosts in VLAN 10 and VLAN 20. Now if the two hosts try to ping each other using layer 2 connectivity then the ping will not be successful.

consider when H1 (VLAN 10) pings H2 (VLAN 20):

Now, if we add a router in the scene, the switch will broadcast the received traffic. The traffic will go the router, and the router will use the L3 forwarding table and send the packet back to the switch.

The switch will now send the packet to the host in VLAN 20.

If we take a Wireshark capture at H1, we get VLAN tag 10, and if we take a Wireshark capture at H2, obviously the VLAN tag is 20.

So where exactly in this data path does the addition of the new tag take place.

Assume we are not using SVIs

Topology is something like:

       R1
        |
        S1
      /    \
    H1     H2

Answer 1

There are a few things wrong with what you wrote.

If you capture at the hosts, there will not be a VLAN tag on the frame. VLAN tags are used on trunks where there are multiple VLANs so that the network devices can tell which frames belong to which VLAN.

The switch does not broadcast unless the frame is a broadcast frame. A switch will have a MAC address table that has the MAC addresses from the frames' source addresses, and from which switch interfaces the source addresses were seen coming into the switch. The switch will look up a frame destination MAC address in the MAC address table and send the frame to the corresponding interface. If the switch doesn't find the destination MAC address in the table, it will flood the frame to all other switch interfaces in the same broadcast domain (VLAN).

A host will compare the destination IP address to the hosts's IP address and mask to see if it is in the same network. If the destination MAC address is in the same network, it will use ARP to discover the the destination host's MAC address, and use that as the destination MAC address for the frame.

If the destination host's IP address is in a different network, the host will use the MAC address of the configured gateway as the destination MAC address for the frame.

If the connection between the switch and the router is a trunk, both the switch and the router will tag any frames for non-native VLANs. The switch will not include a VLAN tag on the access ports.

---

Edit:

A router will have separate logical interfaces, on the same physical interface, for each VLAN. For a Cisco router, it looks something like this:

interface GigabitEthernet0/0
 description Physical Interface
 no shutdown
!
interface GigabitEthernet0/0.10
 description VLAN 10 Interface
 encapsulation dot1Q 10
 ip address 10.10.10.1 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 no shutdown
!
interface GigabitEthernet0/0.20
 description VLAN 20 Interface
 encapsulation dot1Q 20
 ip address 10.20.20.1 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 no shutdown
!

The encapsulation command on the interface will direct incoming frames on the physical interface to the correct logical interface, and it will add the VLAN tag to any frame exiting the logical interface outbound through the physical interface.

A router will strip off and discard the layer-2 frame to get to the layer-3 packet. After switching the packet to the new interface, a router needs to build a new frame for the new interface.

The VLAN tag added to the frame by the switch on the trunk to the router will be lost when the frame is stripped. The router will add a tag for the new VLAN when it builds the new frame for the new interface. That is where the VLAN tag is changed.