Two machines plugged into the same switch, in the same room, can be completely unable to reach each other, and nothing is broken. The switch has been configured to behave as several separate switches at once. Each of those separate switches is a VLAN.
A VLAN is a broadcast domain. Ports assigned to different VLANs are isolated from each other at layer 2, so a broadcast sent on one never reaches the other, and traffic can only cross between them by going up to a router or a layer 3 switch. Where a single cable needs to carry more than one VLAN, each frame is tagged so the equipment at the far end knows which VLAN it belongs to.
Three things to remember
- One physical switch can host many VLANs, and each VLAN is its own separate broadcast domain.
- Traffic between VLANs has to be routed. A switch on its own will not carry it across.
- Trunk links tag frames so several VLANs can share one cable.
Related explanations
- What Happens When You Hit Print? (The Box In The Cupboard Taught Itself)
- What Does 255.255.255.0 Actually Do? (It’s Been Hiding in Plain Sight for Years)
New explanations go up on the channel first.
Like the drawings? Stick Figure Internet merch.
Stick Figure Internet 