Suppose we have a switch we two hosts in VLAN 10 and VLAN 20. Now if the two hosts try to ping each other using layer 2 connectivity then the ping will not be successful.

consider when H1 (VLAN 10) pings H2 (VLAN 20):

Now, if we add a router in the scene, the switch will broadcast the received traffic. The traffic will go the router, and the router will use the L3 forwarding table and send the packet back to the switch.

The switch will now send the packet to the host in VLAN 20.

If we take a Wireshark capture at H1, we get VLAN tag 10, and if we take a Wireshark capture at H2, obviously the VLAN tag is 20.

So where exactly in this data path does the addition of the new tag take place.

Assume we are not using SVIs

Topology is something like:

      /    \
    H1     H2

There are a few things wrong with what you wrote.

If you capture at the hosts, there will not be a VLAN tag on the frame. VLAN tags are used on trunks where there are multiple VLANs so that the network devices can tell which frames belong to which VLAN.

The switch does not broadcast unless the frame is a broadcast frame. A switch will have a MAC address table that has the MAC addresses from the frames' source addresses, and from which switch interfaces the source addresses were seen coming into the switch. The switch will look up a frame destination MAC address in the MAC address table and send the frame to the corresponding interface. If the switch doesn't find the destination MAC address in the table, it will flood the frame to all other switch interfaces in the same broadcast domain (VLAN).

A host will compare the destination IP address to the hosts's IP address and mask to see if it is in the same network. If the destination MAC address is in the same network, it will use ARP to discover the the destination host's MAC address, and use that as the destination MAC address for the frame.

If the destination host's IP address is in a different network, the host will use the MAC address of the configured gateway as the destination MAC address for the frame.

If the connection between the switch and the router is a trunk, both the switch and the router will tag any frames for non-native VLANs. The switch will not include a VLAN tag on the access ports.


A router will have separate logical interfaces, on the same physical interface, for each VLAN. For a Cisco router, it looks something like this:

interface GigabitEthernet0/0
 description Physical Interface
 no shutdown
interface GigabitEthernet0/0.10
 description VLAN 10 Interface
 encapsulation dot1Q 10
 ip address
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 no shutdown
interface GigabitEthernet0/0.20
 description VLAN 20 Interface
 encapsulation dot1Q 20
 ip address
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 no shutdown

The encapsulation command on the interface will direct incoming frames on the physical interface to the correct logical interface, and it will add the VLAN tag to any frame exiting the logical interface outbound through the physical interface.

A router will strip off and discard the layer-2 frame to get to the layer-3 packet. After switching the packet to the new interface, a router needs to build a new frame for the new interface.

The VLAN tag added to the frame by the switch on the trunk to the router will be lost when the frame is stripped. The router will add a tag for the new VLAN when it builds the new frame for the new interface. That is where the VLAN tag is changed.

  • Yes, I understand the tag will not be on the host but on the trunk. As for the broadcast, the switch will search for the Dmac in its forwarding table, as the receiver is in a different vlan, the switch will not find a matching entry and will eventually broadcast. Not my question is where exactly in the communication between the router and the switch will the change of tags take place. – john Nov 26 '16 at 23:45
  • The switch will tag a frame on the trunk to the router, When the router creates a new frame for the new layer-3 network, it will tag the frame on the trunk fro the new VLAN. The switch will not send the VLAN tag to the receiving host. – Ron Maupin Nov 26 '16 at 23:47
  • ok, so the new frame at the router has the new vlan tag, but then how does a router which operates at layer 3 makes changes in the layer 2 header ? – john Nov 26 '16 at 23:49
  • A router strips the layer-2 frame and discards it, then it must create a new frame for the new network. A router routes at layer-3, but it is still a host on the layer-2 network. – Ron Maupin Nov 26 '16 at 23:51
  • Final doubt, how does a router keep track of which ip address is in which vlan ? Does it maintain another table like the l3 destination address table ? – john Nov 26 '16 at 23:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.