VLAN trunking

VLAN trunking is how multiple VLANs share a single cable between switches without getting mixed up. If VLAN 10 and VLAN 20 each ran their own wire between two switches, you would need a separate cable per VLAN — wasteful. Instead, a trunk is one link that carries frames for many VLANs at once, with each frame stamped to say which VLAN it belongs to. It is like sending letters for many departments down one mail chute, each in an envelope marked with its department name.

The stamp is the 802.1Q tag: a 4-byte field inserted into the Ethernet frame right after the source MAC address, holding the 12-bit VLAN ID (and a priority field). When a switch sends a frame out a trunk port, it adds the tag for that frame's VLAN; the switch at the other end reads the tag, strips it, and delivers the frame only into the matching VLAN. Ports come in two flavours: an access port carries one VLAN's untagged traffic to an end device (which knows nothing of VLANs), while a trunk port carries many VLANs' tagged traffic to another switch or a router. One VLAN per trunk — the native VLAN — is conventionally left untagged for backward compatibility.

Trunking is what makes VLANs practical at scale: a single uplink between a floor switch and the core can carry every VLAN in the building. It also enables router-on-a-stick, where one tagged link lets a single router interface route between many VLANs. The honest caveat: trunk ports are powerful and a misconfigured one can expose VLANs you meant to keep apart, so trunks are normally restricted to the exact set of VLANs they should carry.