a VLAN
/ VEE-lan /
A VLAN lets you carve one physical switch into several independent virtual networks, as if you owned several separate switches but only paid for one. Imagine an open-plan office where you draw invisible walls: the sales team and the finance team sit among the same desks and use the same building wiring, yet each group can only talk within its own group. A VLAN is that invisible wall, drawn in software.
Each switch port is assigned to a VLAN, identified by a number (1 to 4094). A frame entering on a port belongs to that port's VLAN, and the switch will only forward it to other ports in the same VLAN — including broadcasts. So each VLAN becomes its own broadcast domain on the very same hardware: a broadcast from a host in VLAN 10 reaches only other VLAN-10 hosts, never VLAN 20. To carry several VLANs over a single link between switches, the frames are tagged with a small 802.1Q tag that records the VLAN number; that shared link is called a trunk. Because VLANs are separate broadcast domains and therefore separate IP subnets, getting from one VLAN to another requires a router or a layer-3 switch — they cannot talk directly at layer 2.
VLANs are everywhere in real networks because they bring the benefits of many physical LANs — smaller broadcast domains, traffic isolation, and security separation (guests cannot see staff traffic) — without the cost of separate switches and cabling. The honest caveat: a VLAN is a logical boundary configured on the switches, not a cryptographic one. Misconfiguration, or attacks like VLAN hopping, can let traffic leak between VLANs, so a VLAN is a segmentation tool, not by itself a strong security guarantee.
On one 24-port switch, ports 1-12 are VLAN 10 (staff) and ports 13-24 are VLAN 20 (guests). A guest's broadcast reaches only other guests; for a guest to reach a staff server, the frame must go up to a router that bridges the two subnets and applies a policy.
One switch, two broadcast domains; crossing between them goes through a router.
A VLAN does break up a broadcast domain (which a plain switch cannot). But VLANs are a logical separation; treat them as segmentation, not as a cryptographic security boundary.