All i have learnt and understood so far about VLAN is - we can create a max of 4k VLANs (subjected to platform capability). However, as per the protocol 802.1Q there is only 12 bits kept for representing VLAN; which results in the range of 4k of VLANs (0-4095).

I wanted to know, is there a way to have VLAN range of 64k (say, 0-65535)? By some means, say by utilizing some bits (User Priority[3bit] and Canonical Format Indicator[1bit]) which are optional and system works even without them (Just a thought, I am not sure) or by some other means - using a variant of 802.1Q protocol?

  • 2
    You could create your own frame format to do whatever you want, but you wouldn't be compatible with any existing device. That's what standards are for. P.S. Those fields are not optional if you need them. – Ron Trunk Apr 25 at 12:41

No. The protocol is specified as it is.

VxLAN (Virtual Extensible LAN) was developed to overcome this limitation. See RFC7348 for details

802.1Q allows different 4094 VLANs, 0 and 4095 are reserved and can't be used.

QinQ (802.1ad) defines inner and outer tags, theoretically allowing 4094^2 VLANs.

Shortest path bridging (802.1aq) uses 24 bits for the VLAN ID, allowing 16 million VLANs.

VXLAN is a slightly different technology in that it tunnels over UDP/IP. This produces much more overhead, eating into the MTU or requiring baby jumbos. The upside is that the tunnel can be routed, the difference to other tunneling protocols being the integrated VLAN service, so a single tunnel can link virtually unlimited L2 segments.

Essentially, you can use any L2 tunneling protocol instead of 802.1Q VLANs - of course, a tunnel wouldn't be as light-weight, as easy to use and usually only point-to-point.

In a completely different approach (and probably more to your intention), you could set up locally administered addresses (LAA) on your NICs, dedicating a few bits to the "VLAN ID" and use MAC-based wildcard filtering on the switches - if you can find switches supporting this. However, since the MAC address and thus the "VLAN ID" originated on the client (instead of the VID on a switch) there wouldn't be any significant security.

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.