Are they only in trunk links between switches/routers' packets?

Is there any way an endpoint sees tagged VLAN packets? (containing VLAN tags) What if I an endpoint sends a tagged packet that corresponds or not to their VLAN?


A tag is required anytime a single link is carrying traffic for more than one VLAN. This excerpt from this answer provides more contexts:

Why is VLAN tagging required?

The real reason you need VLAN Tagging is to distinguish VLAN traffic on a port where multiple VLANs can exist.

An access port is a port which carries traffic for only one VLAN. A Trunk port is a port which carries traffic for multiple VLANs.

On Trunk ports, all the frames are still carried across the wire in the form of 1s and 0s. Something has to exist in order for the sending switch to indicate to the receiving switch which 1s and 0s belong to which VLAN. That something is a VLAN Tag.

The VLAN Tag will be added whenever a frame is crossing a trunk port and removed when the other switch receives the frame. It will look like this:

VLAN Tags being added and removed on Trunk Ports

You can read more about VLANs and how they work in this article, and how to configure them on Cisco switches in this article.

Not the answer you're looking for? Browse other questions tagged or ask your own question.