In this guide
Ethernet frames
An Ethernet frame carries data across a Layer 2 network. The important fields for an engineer are the destination MAC address, source MAC address, EtherType or length field, payload and frame check sequence (FCS). A standard Ethernet switch normally makes its forwarding decision from the destination MAC and VLAN context.
802.1Q adds a VLAN tag to an Ethernet frame when a frame needs to carry VLAN identity across a trunk. The tag includes a VLAN identifier and priority information used by mechanisms such as 802.1p.
MAC learning and forwarding
When a switch receives a frame, it learns the source MAC address against the ingress port and VLAN. It then looks for the destination MAC in the relevant forwarding table.
| Destination | Typical switch behaviour |
|---|---|
| Known unicast | Forward only through the port associated with that MAC in the same VLAN. |
| Unknown unicast | Flood within the VLAN, excluding the ingress port, subject to switch features. |
| Broadcast | Flood within the VLAN. |
| Multicast | May be flooded or selectively forwarded depending on multicast configuration. |
MAC entries age out so that a device can move ports without leaving a permanent stale entry. If the same MAC appears on different ports repeatedly, investigate a loop, redundant path, virtual machine mobility or a device using multiple interfaces.
VLANs and broadcast domains
A VLAN creates a logical Layer 2 broadcast domain. Devices in VLAN 110 do not normally receive broadcasts from VLAN 120. A router or Layer 3 switch is required to route between the corresponding IP subnets.
VLAN numbers are locally significant to the switching design. The fact that two sites both use VLAN 110 does not automatically mean their VLANs are connected. What matters is where the VLAN is carried and how Layer 3 boundaries are designed.
Access and trunk ports
Access ports
An access port normally presents one untagged VLAN to an endpoint. The endpoint sends ordinary Ethernet frames and does not need to understand 802.1Q.
Trunk ports
A trunk carries multiple VLANs between infrastructure devices. Depending on the platform, one VLAN may be configured as an untagged or native VLAN while the remaining VLANs are tagged. The exact terminology differs between vendors, so always verify the actual forwarding state rather than assuming that “trunk” means the same thing everywhere.
| Symptom | Likely area to check |
|---|---|
| Endpoint has no DHCP lease | Access VLAN, DHCP scope, trunk allowance and relay. |
| One VLAN works but another does not | Allowed VLAN list, tagging/native VLAN and downstream configuration. |
| Hosts can reach their gateway but not another VLAN | Layer 3 routing, ACLs and return path. |
| Intermittent connectivity | Loops, STP events, MAC flapping, LAG issues or physical errors. |
Voice VLANs
IP phones commonly need a voice VLAN while a computer connected through the phone remains on a data VLAN. A switch port may therefore have an untagged data VLAN and a tagged voice VLAN, with the phone identifying itself using vendor-specific discovery, LLDP-MED or a manually configured voice VLAN.
Do not assume that detecting a phone's MAC OUI is sufficient for every deployment. OUI-based classification can be useful, but LLDP-MED and explicit port configuration may be more deterministic. Verify both the phone's DHCP lease and the VLAN tags actually seen on the wire.
LAG and LACP
A Link Aggregation Group combines multiple physical links into one logical interface. LACP allows peers to negotiate and maintain the bundle. Aggregation increases available capacity and can provide resilience, but a single flow is normally hashed onto one member rather than being striped packet-by-packet across every link.
When troubleshooting a LAG, check that both sides agree on membership, speed, duplex, VLAN configuration and LACP state. A common mistake is configuring one member differently from its partner or attempting to change a property that is inherited from the logical bundle.
Where Layer 3 begins
VLANs separate Layer 2 domains; they do not replace routing. A common design places a Layer 3 interface, sometimes called an SVI or VLAN interface, on a router or Layer 3 switch. Hosts use that interface as their default gateway.
A packet crossing from VLAN 110 to VLAN 120 is no longer being switched purely as an Ethernet frame between hosts. The gateway receives the packet, makes a routing decision and sends a new Ethernet frame towards the destination network.
Troubleshooting workflow
- Confirm the endpoint link is physically up and operating at the expected speed.
- Identify the endpoint's VLAN and expected IP subnet.
- Check the switch port's access/untagged and tagged VLAN state.
- Check the MAC address table for the endpoint.
- Check the uplink and verify that the VLAN is permitted end-to-end.
- Check STP state and look for topology changes or blocked links.
- Check ARP/ND and the default gateway once Layer 2 is proven.
- Check routing, ACLs and firewall policy for traffic leaving the VLAN.
- Use a packet capture when the configuration view does not explain the observed behaviour.
Key takeaways
Switching is fundamentally about forwarding Ethernet frames inside a Layer 2 domain. VLANs divide those domains, trunks transport multiple VLANs between infrastructure devices, and Layer 3 routing connects the resulting IP networks. Most switching faults become much easier once those three concepts are kept separate.