VLAN

Published on:

Most important commands to remember

  • ip -d link show type vlan — inspect VLAN interfaces and their IDs.
  • bridge vlan show — inspect Linux bridge-port VLAN membership.

Commands and flags

Option or argument Meaning
-d Include detailed link attributes.
type vlan Restrict the interface list to VLAN devices.
bridge vlan show List VLAN membership and flags on bridge ports.

These are two different configuration views. A VLAN subinterface and a VLAN-aware bridge port are not the same object.

The concepts that matter

1. A VLAN separates local Ethernet delivery

A Virtual LAN (VLAN) divides an Ethernet network into separate Layer 2 broadcast domains. Devices in different VLANs do not exchange ordinary local frames merely because they connect to the same physical switch.

This lets shared switching infrastructure carry distinct local networks. The separation depends on correct switch and port configuration; a VLAN name is not itself an authorization policy for an application.

An IEEE 802.1Q tag carries a VLAN identifier in an Ethernet frame. A link can transport frames for multiple VLANs using those tags. An endpoint-facing port often carries one VLAN without requiring the endpoint to tag its traffic.

Common switch terminology calls these trunk and access behaviors. The usable ordinary VLAN IDs are 1–4094; special values exist outside that range. A VLAN ID is neither an IP address nor a TCP port.

3. Ingress classification and egress tagging differ

A port’s PVID assigns incoming untagged traffic to a VLAN. An egress untagged setting decides whether frames leave without a VLAN tag. Those settings answer different directional questions.

A mismatch can put apparently connected endpoints into different networks. Seeing no tag at an endpoint can be completely normal for an untagged access port. Inspect both sides’ membership rather than assuming every frame must visibly carry a tag.

4. Crossing VLANs normally requires routing

A VLAN is a Layer 2 boundary; an IP subnet is a Layer 3 address range. They are often designed together, but the concepts are not identical. Assigning the same IPv4 prefix on isolated VLANs does not magically connect them.

Communication between VLANs typically passes through a router or Layer 3 switch, where routing and filtering apply. VLAN segmentation can reduce local exposure, while policy on routed traffic controls which services may cross the boundary.

One small example

Optional: run the commands in a Linux terminal. No administrator access or temporary network setup is needed.

ip -d link show type vlan
bridge vlan show

In the first output, look for the VLAN id, encapsulation protocol such as 802.1Q, and underlying interface. An interface name ending in a number is only a naming convention; the detailed attributes establish its VLAN configuration.

The second output associates port names with VLAN IDs. PVID describes incoming untagged classification; Egress Untagged describes outgoing tag removal. Bridge VLAN filtering must be enabled for a VLAN-aware bridge to enforce its membership configuration.

Empty output is normal if this host has no such objects. A cloud or physical switch can use VLANs outside this view, so no local VLAN interface does not prove that no VLAN exists anywhere. No cleanup is needed.

Keep this idea: A VLAN defines local frame membership; tags transport that identity, and routing connects separate networks.