0

have been trying to understand ingress behaviour on untagged port, specially w.r.t tagged frames. On going through ieee 802.1q doc, i found this (8.6.2) :

"Each Port may support an Enable Ingress Filtering parameter. A frame received on a Port that is not in the member set (8.8.9) associated with the VID shall be discarded if this parameter is set. The default value for this parameter is reset, i.e., Disable Ingress Filtering, for all Ports. Any Port that supports setting this parameter shall also support resetting it. The parameter may be configured by the management operations defined in Clause 12."

It only speaks about VID of incoming frame . From that, My understanding is, incoming frame (whether it is tagged or untagged / irrespective of port type ) must be looked upon VLAN database and forwarded /discarded accordingly. Furthermore, the doc mainly defines functionality of a port in terms of a Bridge, and only classifies them as VLAN aware and unaware types (Here again , i assume, trunk and access type respectively). It also specfies that an untagged traffic is associated(assume tagged) with PVID of that particular port. It doesn't effectively specify the scenario of tagged traffic on to the untagged port. However, most of online forums say that a untagged port should discard tagged frames, (some say with exception of native vlan). !! Ps: For Scenario, A pc is connected to access port of switch, using a traffic generator tool on pc i can send tagged frames!! , What about the behaviour of that switchport??

Again, Why this behaviour is not as per standard?!!

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Dec 17, 2020 at 17:39

2 Answers 2

Reset to default
3

This question has been asked at least a dozen times.

We can only guess why the spec says what it says -- no one here wrote it.

Despite what the spec says, no one does that -- "ingress filtering" is always enabled on a VLAN aware switch: if vlan 20 isn't not assigned to the port, anything tagged 20 will be dropped.

As for untagged traffic, yes, it too (internally) belongs to a VLAN. That's what the native or primary (PVID) VLAN is all about. Yes, some switches will allow the PVID to be tagged, others will not allow any tagged frames on a designated "access" port.

You'll need to list specific hardware to get a concrete answer. Anything is possible, and whatever you can think of, someone has actually implemented. (Broadcom hardware supports "untagAll", which on the surface may seem stupid, but I'm sure someone, somewhere has actually used it. And yes, "untagAll" and "filter-untagged-frame" can be set at the same time.)

Improve this answer
4
  • Looking for Broadcom hardware, specifically Bcm 53128!!
    – prudv
    May 25, 2020 at 21:51
  • Consult the datasheet (public), and other documents (NDA). By default -- without extra configuration -- all ports are in VLAN 1, untagged. Tagged frames will be dropped. (tagged vlan 1 is anyones guess)
    – Ricky
    May 26, 2020 at 0:39
  • “some switches will allow the PVID to be tagged, others will not allow any tagged frames [on a designated "access" port].”: this is the part that’s had me scratch my head! It’s quite a crucial part and you’d hope the spec would define the expected behaviour. It would be quite useful for a port with a set PVID to support both untagged and tagged (with PVID or other supported VID) traffic and “mark” the untagged traffic with the PVID. Yet the switch I’m using here (TP-Link managed with Omada SDN controller) seems to reject inbound traffic tagged with the PVID...
    – sxc731
    Feb 11, 2021 at 7:35
  • An "access" port is not a "trunk" port, so it's an "untagged" port. It's perfectly reasonable to ignore any tagged frame on such a port... it's not configured for tags. It's just an oddity that some switches will allow PVID tagged traffic on an otherwise untagged port. (strongly suggests those ports aren't actually untagged)
    – Ricky
    Feb 11, 2021 at 23:02
0

You mentioned in a comment to @Ricky Beam answer Broadcom bcm 53128

This is an un-managed switch. Which means you cannot configure anything on it, so no VLAN configuration.

Such switches are VLAN agnostic. They don't care about the VLAN tag and treat the first 2 bytes of the 802.1Q header as the EtherType header (or can understand that it is a 802.1Q header but doesn't process it).

This behavior IS per the standard.

Improve this answer
3
  • I didn't really got the concept of "unmanaged switch" . Can you explain please!!?. For bcm53128, i think it has chipset registers which are configured by the Application/OS to do operations like learning Mac addresses, Vlan entries etc..,
    – prudv
    May 26, 2020 at 0:02
  • Unmanaged, as in "it does not have a management interface", nor does it need one. Yes, the 128 has numerous registers and is 802.1q aware, supporting 802.1p and port based VLANs (i.e. static assignment)
    – Ricky
    May 26, 2020 at 0:37
  • As they've put an 8051 inside it, and it has an SGMII CPU interface (that can be directed to the microcontroller), calling this thing "unmanaged" is a bit like calling your cellphone data plan "unlimited". The little switches that use these things either have no management at all, or their management is extremely crude. (actually impressive given a web UI has been wedged into an 8051.)
    – Ricky
    May 26, 2020 at 0:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.