have been trying to understand ingress behaviour on untagged port, specially w.r.t tagged frames. On going through ieee 802.1q doc, i found this (8.6.2) :

"Each Port may support an Enable Ingress Filtering parameter. A frame received on a Port that is not in the member set (8.8.9) associated with the VID shall be discarded if this parameter is set. The default value for this parameter is reset, i.e., Disable Ingress Filtering, for all Ports. Any Port that supports setting this parameter shall also support resetting it. The parameter may be configured by the management operations defined in Clause 12."

It only speaks about VID of incoming frame . From that, My understanding is, incoming frame (whether it is tagged or untagged / irrespective of port type ) must be looked upon VLAN database and forwarded /discarded accordingly. Furthermore, the doc mainly defines functionality of a port in terms of a Bridge, and only classifies them as VLAN aware and unaware types (Here again , i assume, trunk and access type respectively). It also specfies that an untagged traffic is associated(assume tagged) with PVID of that particular port. It doesn't effectively specify the scenario of tagged traffic on to the untagged port. However, most of online forums say that a untagged port should discard tagged frames, (some say with exception of native vlan). !! Ps: For Scenario, A pc is connected to access port of switch, using a traffic generator tool on pc i can send tagged frames!! , What about the behaviour of that switchport??

Again, Why this behaviour is not as per standard?!!


This question has been asked at least a dozen times.

We can only guess why the spec says what it says -- no one here wrote it.

Despite what the spec says, no one does that -- "ingress filtering" is always enabled on a VLAN aware switch: if vlan 20 isn't not assigned to the port, anything tagged 20 will be dropped.

As for untagged traffic, yes, it too (internally) belongs to a VLAN. That's what the native or primary (PVID) VLAN is all about. Yes, some switches will allow the PVID to be tagged, others will not allow any tagged frames on a designated "access" port.

You'll need to list specific hardware to get a concrete answer. Anything is possible, and whatever you can think of, someone has actually implemented. (Broadcom hardware supports "untagAll", which on the surface may seem stupid, but I'm sure someone, somewhere has actually used it. And yes, "untagAll" and "filter-untagged-frame" can be set at the same time.)

| improve this answer | |
  • Looking for Broadcom hardware, specifically Bcm 53128!! – prudv May 25 at 21:51
  • Consult the datasheet (public), and other documents (NDA). By default -- without extra configuration -- all ports are in VLAN 1, untagged. Tagged frames will be dropped. (tagged vlan 1 is anyones guess) – Ricky Beam May 26 at 0:39

You mentioned in a comment to @Ricky Beam answer Broadcom bcm 53128

This is an un-managed switch. Which means you cannot configure anything on it, so no VLAN configuration.

Such switches are VLAN agnostic. They don't care about the VLAN tag and treat the first 2 bytes of the 802.1Q header as the EtherType header (or can understand that it is a 802.1Q header but doesn't process it).

This behavior IS per the standard.

| improve this answer | |
  • I didn't really got the concept of "unmanaged switch" . Can you explain please!!?. For bcm53128, i think it has chipset registers which are configured by the Application/OS to do operations like learning Mac addresses, Vlan entries etc.., – prudv May 26 at 0:02
  • Unmanaged, as in "it does not have a management interface", nor does it need one. Yes, the 128 has numerous registers and is 802.1q aware, supporting 802.1p and port based VLANs (i.e. static assignment) – Ricky Beam May 26 at 0:37
  • As they've put an 8051 inside it, and it has an SGMII CPU interface (that can be directed to the microcontroller), calling this thing "unmanaged" is a bit like calling your cellphone data plan "unlimited". The little switches that use these things either have no management at all, or their management is extremely crude. (actually impressive given a web UI has been wedged into an 8051.) – Ricky Beam May 26 at 0:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.