IEEE 802.1Q VLAN Tagging and IEEE 802.1p Layer 2 Priority Encoding Explained
VLANs and traffic prioritization are fundamental technologies in modern Ethernet networks. Two terms that frequently appear in managed switches, enterprise n...
VLANs and traffic prioritization are fundamental technologies in modern Ethernet networks. Two terms that frequently appear in managed switches, enterprise network adapters, servers, IP phones, wireless access points, hypervisors, and router configuration screens are IEEE 802.1Q VLAN tagging and IEEE 802.1p Layer 2 priority.
They are closely related, but they solve different problems:
- 802.1Q identifies which VLAN an Ethernet frame belongs to.
- 802.1p-style priority information identifies how important the Ethernet frame should be treated for Layer 2 QoS purposes.
Both pieces of information can be carried within the IEEE 802.1Q VLAN tag.
Understanding the distinction is important because enabling VLAN tagging does not automatically prioritize traffic, and assigning priority does not by itself create separate VLANs.
Quick Answer
IEEE 802.1Q VLAN tagging adds VLAN information to an Ethernet frame so VLAN-aware switches and other network equipment can identify the frame's VLAN membership.
A standard 802.1Q tag adds 4 bytes to the Ethernet frame and contains information including:
- Tag Protocol Identifier (TPID)
- Priority Code Point (PCP)
- Drop Eligible Indicator (DEI)
- VLAN Identifier (VID)
The commonly used TPID for a customer 802.1Q VLAN tag is:
0x8100
The VLAN ID field is 12 bits. The normal configurable VLAN IDs are therefore generally:
1–4094
VLAN ID 0 has a special priority-tagging meaning, while 4095 is reserved.
IEEE 802.1p priority, commonly represented today through the 3-bit Priority Code Point (PCP) field of the 802.1Q tag, provides eight possible priority values:
0–7
These values allow switches to classify Ethernet frames into different traffic priorities or queues.
A simple way to remember the relationship is:
802.1Q = Which logical network does this frame belong to?
PCP/802.1p priority = How should this frame be prioritized?
What Is a VLAN?
VLAN stands for:
Virtual Local Area Network
A VLAN logically divides a physical Ethernet network into separate Layer 2 broadcast domains.
Imagine one physical managed switch connected to:
- Office computers
- Servers
- IP phones
- CCTV cameras
- Guest Wi-Fi
- Network-management devices
Without VLANs, these systems may all belong to the same Layer 2 broadcast domain.
With VLANs, the administrator could design:
| VLAN | Purpose | Example subnet |
|---|---|---|
| VLAN 10 | Office computers | 192.168.10.0/24 |
| VLAN 20 | Servers | 192.168.20.0/24 |
| VLAN 30 | VoIP phones | 192.168.30.0/24 |
| VLAN 40 | CCTV | 192.168.40.0/24 |
| VLAN 50 | Guest Wi-Fi | 192.168.50.0/24 |
| VLAN 99 | Network management | 192.168.99.0/24 |
These VLAN numbers and IP subnets are examples only; VLANs themselves are a Layer 2 concept and do not inherently require those particular IP networks.
Devices in different VLANs normally require a Layer 3 device—such as a router, firewall, or Layer 3 switch—to communicate with each other.
This process is known as inter-VLAN routing.
Why VLAN Tagging Is Necessary
Consider two managed switches:
VLAN 10 PCs
|
+-------------+
| Switch A |
+-------------+
|
| One Ethernet Link
|
+-------------+
| Switch B |
+-------------+
| |
VLAN 10 VLAN 20Suppose the link between Switch A and Switch B must carry traffic for:
- VLAN 10
- VLAN 20
- VLAN 30
- VLAN 40
The receiving switch needs some way to determine which VLAN each Ethernet frame belongs to.
IEEE 802.1Q solves this by inserting VLAN information into the Ethernet frame.
What Is IEEE 802.1Q VLAN Tagging?
IEEE 802.1Q defines mechanisms used for VLAN-aware bridged Ethernet networks.
When a frame is VLAN tagged, a 4-byte 802.1Q tag is inserted into the Ethernet frame.
A simplified normal Ethernet frame looks like:
+-------------+-------------+------------+---------+------+
| Destination | Source MAC | EtherType | Payload | FCS |
+-------------+-------------+------------+---------+------+With an 802.1Q tag:
+-------------+-------------+----------+----------+------------+---------+------+
| Destination | Source MAC | TPID | TCI | EtherType | Payload | FCS |
+-------------+-------------+----------+----------+------------+---------+------+
<--- 4 bytes --->The tag is inserted after the source MAC address and before the original EtherType/Length field.
Because the Ethernet frame changes, the Frame Check Sequence (FCS) must also be recalculated.
Structure of the IEEE 802.1Q Tag
The 802.1Q tag occupies 32 bits (4 bytes).
Conceptually:
802.1Q Tag
------------------------------------------------
| TPID | TCI |
| 16 bits | 16 bits |
------------------------------------------------
TCI
------------------------------------------------
| PCP | DEI | VLAN ID |
|3 bit|1 bit| 12 bits |
------------------------------------------------The major fields are:
| Field | Size | Purpose |
|---|---|---|
| TPID | 16 bits | Identifies the VLAN-tagged frame |
| PCP | 3 bits | Layer 2 priority information |
| DEI | 1 bit | Drop eligibility indication |
| VLAN ID | 12 bits | Identifies VLAN membership |
Let's examine them individually.
TPID — Tag Protocol Identifier
TPID stands for:
Tag Protocol Identifier
It occupies 16 bits.
For a conventional IEEE 802.1Q customer VLAN tag, the commonly used value is:
0x8100
When a VLAN-aware Ethernet device encounters this value in the relevant location, it recognizes the following information as VLAN tag information.
TCI — Tag Control Information
TCI stands for:
Tag Control Information
It is another 16-bit field containing:
PCP = 3 bits
DEI = 1 bit
VLAN ID = 12 bitsTherefore:
3 + 1 + 12 = 16 bitsVLAN Identifier — VID
The VLAN Identifier is a 12-bit field.
Twelve bits provide 4096 possible binary values:
0–4095
However, not all are ordinary configurable VLAN IDs.
| VLAN ID | Meaning |
|---|---|
| 0 | Special/null VLAN ID used for priority-tagged frames |
| 1 | Common default PVID on many implementations |
| 2–4094 | Generally available VLAN IDs |
| 4095 | Reserved |
Therefore, a typical VLAN-capable network has VLAN IDs 1 through 4094 available for normal use, subject to the capabilities and restrictions of the specific device.
What Is VLAN ID 0?
VLAN 0 is frequently misunderstood.
A VID value of 0 does not represent an ordinary VLAN that you create and use like VLAN 10 or VLAN 20.
Instead, it indicates that the tag contains priority information without assigning the frame to an ordinary VLAN ID through that tag.
Such frames are often called priority-tagged frames.
This demonstrates how closely VLAN tagging and Layer 2 priority are related.
What Is IEEE 802.1p Layer 2 Priority Encoding?
IEEE 802.1p terminology is commonly used for Ethernet Layer 2 traffic prioritization.
In modern IEEE 802.1Q terminology, the important field is the:
PCP — Priority Code Point
PCP occupies 3 bits in the VLAN tag.
Three bits allow:
2³ = 8
possible values:
0–7
The PCP value can be used by VLAN-aware bridges and switches to classify traffic for different handling, such as placing frames into different queues.
IEEE 802.1p / PCP Priority Values
The eight PCP values are:
| PCP | Traditional priority designation | General interpretation |
|---|---|---|
| 0 | Best Effort | Normal/default traffic |
| 1 | Background | Low-priority background traffic |
| 2 | Excellent Effort | Higher than background/best-effort class in traditional mapping |
| 3 | Critical Applications | Business-critical applications |
| 4 | Video | Delay-sensitive video |
| 5 | Voice | Delay-sensitive voice |
| 6 | Internetwork Control | Network-control traffic |
| 7 | Network Control | Highest control priority |
The exact mapping between PCP values, queues, and application classes is not something administrators should assume blindly. Modern switches may support configurable PCP-to-queue mappings and different QoS profiles.
A common misconception is:
PCP 7 means that any application marked 7 automatically receives maximum network performance.
It does not.
The switch must be configured to trust and act on the marking, and congestion must actually exist for queue scheduling to become particularly relevant.
PCP Is Not Bandwidth Reservation
Priority and bandwidth are not the same thing.
For example:
PCP 5 = Voicedoes not mean:
Reserve 50% bandwidth for voice.PCP is a classification/priority marking.
The switch's QoS configuration determines what happens to traffic with that marking.
Depending on the switch, this may involve:
- Traffic queues
- Queue scheduling
- Strict priority
- Weighted scheduling
- Traffic shaping
- Policing
- Congestion management
- Drop policies
Therefore:
PCP marks traffic; QoS policy determines how the network handles that marking.
What Is DEI?
DEI stands for:
Drop Eligible Indicator
It occupies one bit of the VLAN tag.
Conceptually, DEI can help identify traffic that is more eligible to be discarded when congestion occurs.
It is particularly relevant in networks using more sophisticated traffic engineering or provider-bridging technologies.
For a typical small office VLAN configuration, administrators interact much more frequently with VLAN ID and PCP than with DEI.
IEEE 802.1Q vs IEEE 802.1p
The simplest comparison is:
| Feature | 802.1Q | 802.1p-style priority |
|---|---|---|
| Main purpose | VLAN identification/bridging | Layer 2 traffic priority |
| Main field | VLAN ID | PCP |
| Field size | 12 bits | 3 bits |
| Values | VLAN IDs | 0–7 |
| Layer | Layer 2 | Layer 2 |
| Typical use | Network segmentation | QoS |
| Example | VLAN 20 | PCP 5 |
| Carried in 802.1Q tag | Yes | Yes |
The technologies complement one another.
A tagged Ethernet frame can therefore communicate information equivalent to:
“This frame belongs to VLAN 30 and has PCP priority 5.”
Tagged vs Untagged Ethernet Frames
Understanding tagged and untagged traffic is essential for configuring VLANs.
Untagged Frame
An untagged Ethernet frame contains no 802.1Q VLAN tag.
Typical endpoint devices may receive ordinary untagged Ethernet frames.
Examples include:
- Desktop computers
- Basic printers
- Many CCTV cameras
- Ordinary unmanaged devices
Tagged Frame
A tagged frame contains an 802.1Q tag.
Tagged traffic is frequently found on links between VLAN-aware devices such as:
- Switch-to-switch links
- Switch-to-router links
- Switch-to-firewall links
- Switch-to-server links
- Hypervisor uplinks
- VLAN-aware wireless access points
Access Ports vs Trunk Ports
Vendor terminology varies, but access and trunk are widely used operational terms.
Access Port
An access port normally connects an endpoint to one VLAN.
Example:
PC
|
|
Switch Port
VLAN 10The PC can normally send and receive ordinary untagged Ethernet frames.
The switch associates those frames with VLAN 10 internally.
Trunk Port
A trunk-style link normally carries multiple VLANs.
Example:
VLAN 10
VLAN 20
VLAN 30
VLAN 40
|
+------------+
| Switch A |
+------------+
|
| 802.1Q
|
+------------+
| Switch B |
+------------+Frames transmitted across the link can carry VLAN tags so the receiving device knows their VLAN membership.
Example of VLAN Tagging
Suppose a switch receives traffic from a computer connected to an access port assigned to:
VLAN 20
The computer sends an ordinary Ethernet frame:
PC
|
| Untagged
v
SwitchInternally, the switch associates the frame with VLAN 20.
If the frame needs to travel over a tagged link:
PC
|
| Untagged
v
Switch A
|
| Tagged: VLAN 20
v
Switch B
|
| Untagged
v
Destination PCThe VLAN tag exists where it is needed to preserve VLAN information across the VLAN-aware network.
Endpoints therefore do not necessarily need to understand VLAN tagging.
What Is PVID?
PVID stands for:
Port VLAN Identifier
It is commonly used to determine which VLAN should be associated with incoming untagged traffic on a VLAN-aware switch port.
For example:
Port 5
PVID = 20An untagged frame arriving on Port 5 may therefore be classified into VLAN 20.
The exact configuration terminology varies among switch vendors.
PVID vs VLAN ID
These terms should not be confused.
VLAN ID
Identifies a VLAN.
Example:
VLAN 20
PVID
Defines the VLAN classification applied to untagged ingress traffic on a particular port.
Example:
Port 5 PVID = 20
What Is a Native VLAN?
On equipment that uses the term native VLAN, a trunk can be configured so that one VLAN's traffic is transmitted untagged.
For example:
Allowed VLANs: 10,20,30,40
Native VLAN: 10Depending on vendor configuration, VLAN 10 traffic may cross that link without an 802.1Q tag while the other VLANs are tagged.
Both ends of the link should be configured consistently.
A native VLAN mismatch can cause connectivity problems and may create security concerns.
VLAN Tagging and MTU
An 802.1Q tag adds:
4 bytes
to the Ethernet frame.
This means network engineers must consider the additional Layer 2 overhead when working with devices, tunnels, provider networks, or environments with strict frame-size limits.
Cisco documentation, for example, notes that adding an outer VLAN tag increases the packet/frame requirement by four bytes and discusses increasing interface MTU appropriately in such environments.
In ordinary modern switched networks, equipment designed for VLAN operation normally handles standard VLAN-tagged Ethernet correctly, but MTU becomes particularly important when stacking additional encapsulation.
What Is QoS?
QoS stands for:
Quality of Service
QoS is a broad collection of technologies used to classify and manage network traffic.
QoS becomes important when multiple types of traffic compete for limited network resources.
For example:
Internet Download
File Backup
VoIP Call
Video Meeting
Cloud Synchronization
Database TrafficWithout suitable QoS policies, a large transfer can contribute to congestion that increases latency or packet loss for delay-sensitive applications.
QoS mechanisms can help networks distinguish between these traffic types.
802.1p/PCP and QoS
PCP provides Layer 2 traffic classification information.
For example:
Normal data
PCP 0
Voice
PCP 5A properly configured switch could map those markings into different hardware queues.
Conceptually:
Incoming Frames
|
v
+------------------+
| Read PCP Marking |
+------------------+
|
+---- PCP 0 ---> Normal Queue
|
+---- PCP 5 ---> Voice Queue
|
+---- PCP 7 ---> Control QueueActual queue mapping is device- and configuration-dependent.
What Is CoS?
CoS stands for:
Class of Service
In Ethernet networking, the term is frequently used in vendor documentation when discussing Layer 2 priority based on PCP/802.1p markings.
For practical purposes, you may encounter terminology such as:
- 802.1p priority
- PCP
- CoS value
- Layer 2 priority
- VLAN priority
These terms often refer to closely related Layer 2 QoS concepts, although exact vendor terminology and implementation should always be checked.
802.1p/PCP vs DSCP
This is another important distinction.
PCP
PCP is Layer 2 information.
It exists within an IEEE 802.1Q VLAN tag.
It contains:
3 bits
giving values:
0–7
DSCP
DSCP stands for:
Differentiated Services Code Point
It operates in the IP header at:
Layer 3
DSCP uses six bits of the IP Differentiated Services field for classification.
Therefore:
| Feature | PCP / 802.1p | DSCP |
|---|---|---|
| OSI layer | Layer 2 | Layer 3 |
| Location | 802.1Q tag | IP header |
| Classification bits | 3 | 6 |
| Basic value space | 0–7 | 0–63 |
| Typical scope | Ethernet segment/domain | Routed IP network |
| Common purpose | Layer 2 QoS | Layer 3 QoS |
Enterprise equipment can map Layer 2 PCP values to Layer 3 DSCP values and vice versa according to configured QoS policies.
The mapping should not be assumed to be universally identical across all networks.
Example: VoIP Network
Consider an office containing:
- Computers
- IP phones
- Servers
- CCTV cameras
An administrator might create:
VLAN 10 = Computers
VLAN 20 = Servers
VLAN 30 = Voice
VLAN 40 = CCTVThe voice network might use VLAN 30 while voice traffic is assigned an appropriate QoS marking.
These solve separate problems:
VLAN 30
|
+---- Identifies the logical Voice VLAN
PCP
|
+---- Provides Layer 2 traffic priority informationThe VLAN separates traffic logically.
The QoS marking helps network equipment prioritize delay-sensitive traffic where appropriate.
Voice VLANs
Many managed switches have a dedicated feature called:
Voice VLAN
It can simplify deployment of IP phones by automatically or manually assigning phone traffic to a dedicated VLAN.
For example:
PC VLAN = 10
Voice VLAN = 30A common physical arrangement is:
Switch
|
IP Phone
|
ComputerThe phone may tag its voice traffic for VLAN 30 while the connected computer's traffic belongs to VLAN 10.
The exact behavior depends on the IP phone and switch configuration.
VLANs and Wireless Networks
VLANs are also widely used with enterprise wireless access points.
For example:
Corporate SSID
|
VLAN 10
Guest SSID
|
VLAN 50
IoT SSID
|
VLAN 60The access point's Ethernet uplink can carry multiple VLANs using 802.1Q tagging.
This allows one physical access point to provide multiple logically separated networks.
VLANs and Virtualization
VLAN tagging is extremely important in virtualized environments.
A physical server might run:
Virtual Machine 1 → VLAN 10
Virtual Machine 2 → VLAN 20
Virtual Machine 3 → VLAN 30
Virtual Machine 4 → VLAN 40One physical NIC or bonded NIC team can potentially carry traffic for multiple VLANs to the physical switch.
Technologies from VMware, Hyper-V, Linux virtualization, containers, and other platforms commonly rely on VLAN-aware virtual switches or bridges.
VLAN Tagging in Network Adapters
Some Ethernet NIC drivers expose advanced properties such as:
- VLAN ID
- Priority & VLAN
- Priority & VLAN Enabled
- Packet Priority
- VLAN Tagging
- 802.1p
- 802.1Q
- VLAN & Priority
The exact options depend on:
- NIC manufacturer
- Driver version
- Operating system
- Hardware capabilities
- OEM customization
You should not enable VLAN tagging on a Windows PC simply because the option exists.
It should only be configured when the switch and network architecture expect the endpoint to send tagged traffic.
Incorrect VLAN ID settings can immediately disconnect the computer from the network.
Example: VLAN Configuration on a Server NIC
Suppose the network administrator tells you:
Server VLAN = 20There are two possible architectures.
Architecture 1 — Switch handles VLAN
Server
|
Untagged
|
Switch Access Port
VLAN 20The server does not need to tag frames.
Architecture 2 — Server handles VLAN
Server
|
802.1Q VLAN 20
|
Switch Tagged/Trunk PortHere, the server or its virtual switch must understand and generate VLAN tags.
Do not confuse these architectures.
What Is Inter-VLAN Routing?
VLANs create separate Layer 2 broadcast domains.
Suppose:
VLAN 10
192.168.10.0/24
VLAN 20
192.168.20.0/24A computer in VLAN 10 cannot communicate directly at Layer 2 with a computer in VLAN 20.
Communication between them requires Layer 3 routing.
This can be provided by:
- Router
- Firewall
- Layer 3 switch
- Virtual router/firewall
This is called:
Inter-VLAN routing
What Is Router-on-a-Stick?
Router-on-a-stick is a design where one physical router interface carries multiple VLANs using 802.1Q tags.
Conceptually:
VLAN 10
VLAN 20
VLAN 30
|
Switch
|
802.1Q Trunk
|
RouterThe router creates logical subinterfaces, typically one for each VLAN.
This design is useful for smaller networks but may become a bottleneck compared with Layer 3 switching in larger environments.
What Is IEEE 802.1ad / QinQ?
Another technology related to VLAN tagging is:
IEEE 802.1ad Provider Bridging
It is commonly associated with:
QinQ
or:
VLAN stacking
Instead of carrying one VLAN tag, traffic can carry an additional provider/service tag around a customer VLAN tag.
Conceptually:
Normal Ethernet
|
v
Customer VLAN Tag
|
v
Provider VLAN Tag
|
v
Ethernet FrameThis allows service-provider networks to transport customer VLANs across shared infrastructure.
You may see terminology such as:
- C-VLAN
- C-TAG
- S-VLAN
- S-TAG
- QinQ
- VLAN stacking
QinQ is generally an advanced provider, carrier, data-center, or specialized enterprise networking feature rather than something required for an ordinary office VLAN.
Related IEEE 802.1 Technologies
IEEE 802.1Q has evolved far beyond the simple idea of adding VLAN numbers to Ethernet frames.
Related technologies and concepts include:
| Technology | Purpose |
|---|---|
| IEEE 802.1Q | Bridged networks and VLAN mechanisms |
| PCP / 802.1p terminology | Layer 2 traffic priority |
| IEEE 802.1ad | Provider bridging / commonly associated with QinQ |
| IEEE 802.1X | Port-based network access control |
| IEEE 802.1AX | Link aggregation |
| IEEE 802.1D / STP heritage | Loop prevention and bridging concepts |
| RSTP | Faster spanning-tree convergence |
| MSTP | Multiple spanning-tree operation |
| LLDP | Device/neighbour discovery |
| LLDP-MED | Extensions commonly useful for VoIP/network endpoints |
| TSN family | Deterministic/time-sensitive Ethernet capabilities |
Some technologies originally published separately have subsequently been incorporated or evolved within newer IEEE 802 standards, so current vendor and IEEE documentation should be consulted when implementing them.
VLAN vs Subnet
VLAN and subnet are not synonymous.
VLAN
Primarily a Layer 2 concept.
Subnet
An IP Layer 3 concept.
A common network design maps one IP subnet to one VLAN:
VLAN 10 → 192.168.10.0/24
VLAN 20 → 192.168.20.0/24
VLAN 30 → 192.168.30.0/24This is a common and clean design, but the technologies themselves exist at different layers.
VLAN vs VPN
These are also very different technologies.
| VLAN | VPN |
|---|---|
| Virtual Local Area Network | Virtual Private Network |
| Primarily Layer 2 segmentation | Secure connectivity/tunnelling concept |
| Common inside LANs | Common across untrusted or remote networks |
| Does not inherently encrypt traffic | Common VPN technologies provide encryption |
| Separates broadcast domains | Connects users/sites/networks securely |
A VLAN should never be treated as an encryption mechanism.
VLANs and Security
VLANs can significantly improve network segmentation, but a VLAN is not automatically a complete security boundary.
For example:
VLAN 10 = Employees
VLAN 20 = Servers
VLAN 30 = CCTV
VLAN 40 = Guest Wi-FiThis separation is useful, but traffic between VLANs must still be controlled appropriately.
Security can additionally involve:
- Firewall policies
- Access control lists
- Authentication
- 802.1X
- Network Access Control
- Port security
- DHCP snooping
- Dynamic ARP Inspection
- IP Source Guard
- Endpoint security
Think of VLANs as one component of a layered network-security architecture.
VLAN Hopping
VLAN hopping refers to techniques intended to gain unauthorized access to traffic or networks assigned to another VLAN.
Historical or misconfigured networks may be vulnerable to attacks involving techniques such as:
- Switch spoofing
- Double tagging
Modern managed networks should therefore use secure VLAN configurations rather than relying on default settings.
VLAN Security Best Practices
Good practices include:
- Explicitly configure user-facing ports rather than allowing unnecessary trunk negotiation.
- Allow only required VLANs on trunk links.
- Avoid placing ordinary users on a management VLAN.
- Keep guest networks isolated.
- Protect switch-management interfaces.
- Use firewall rules or ACLs between sensitive VLANs.
- Disable unused switch ports where practical.
- Avoid unnecessary use of default VLAN configurations.
- Keep native VLAN configurations consistent at both ends.
- Document VLAN IDs, names, subnets, gateways, and port assignments.
- Use 802.1X or NAC where stronger endpoint authentication is required.
- Do not assume VLAN separation alone provides confidentiality.
Common VLAN Configuration Mistakes
Mistake 1 — Wrong VLAN ID
Example:
Switch expects:
VLAN 20
NIC sends:
VLAN 30
Result:
Network connectivity may fail completely.
Mistake 2 — Tagged vs Untagged Mismatch
Server sends tagged traffic:
VLAN 20but the switch port expects ordinary untagged endpoint traffic.
The result can be no connectivity or unexpected VLAN behavior.
Mistake 3 — Native VLAN Mismatch
One side:
Native VLAN 10Other side:
Native VLAN 20This can cause traffic to be associated with the wrong VLAN and should be corrected.
Mistake 4 — VLAN Not Allowed on Trunk
Suppose the trunk allows:
10,20,30but the administrator creates:
VLAN 40
Traffic for VLAN 40 will not cross that trunk until it is allowed/configured appropriately.
Mistake 5 — Missing Inter-VLAN Routing
Creating:
VLAN 10
VLAN 20does not automatically allow them to communicate.
A Layer 3 gateway and appropriate routing/firewall configuration are required.
Mistake 6 — Wrong PVID
If untagged frames arrive on a port with the wrong PVID, they can be assigned to an unintended VLAN.
Mistake 7 — Enabling VLAN ID on a PC Without Need
This is particularly common when users find:
VLAN ID
under a NIC's advanced settings.
Do not enable it unless the network is intentionally designed for endpoint VLAN tagging.
How to Troubleshoot VLAN Problems
When VLAN connectivity fails, troubleshoot systematically.
Step 1 — Check Physical Connectivity
Confirm:
- Ethernet link is active
- Cable is working
- Switch port is enabled
- NIC is operational
Step 2 — Verify VLAN Membership
Check:
Correct VLAN ID?For example:
Expected VLAN: 20
Configured VLAN: 30This is an obvious mismatch.
Step 3 — Check Tagged/Untagged Configuration
Determine whether the endpoint should send:
Tagged framesor:
Untagged framesDo not guess.
Step 4 — Check PVID
For untagged ingress traffic, verify that the port's PVID/default VLAN classification is correct.
Step 5 — Check Allowed VLANs
For trunk/tagged links, confirm the VLAN is permitted across the entire path.
For example:
Switch A
|
VLAN 30 allowed
|
Switch B
|
VLAN 30 blocked
|
Switch CThe VLAN must be carried correctly across every required link.
Step 6 — Check IP Configuration
On Windows:
ipconfig /allCheck:
- IP address
- Subnet mask
- Default gateway
- DHCP status
- DNS servers
Step 7 — Test Gateway Connectivity
Example:
ping 192.168.20.1Use the actual gateway configured for your VLAN.
If the gateway cannot be reached, investigate Layer 2/VLAN configuration before assuming DNS is the problem.
Step 8 — Check ARP
On Windows:
arp -aor PowerShell:
Get-NetNeighborThis can help determine whether the system is resolving local Layer 2 neighbours.
Step 9 — Capture Traffic
Wireshark can display VLAN information in captured Ethernet frames when the NIC, driver, capture location, and offloading behavior expose the tags.
Useful fields include:
- VLAN ID
- PCP
- DEI
- EtherType
Be aware that some NIC drivers or hardware offload mechanisms may strip or process VLAN tags before packet-capture software sees them.
Example Network Design
Consider a small business with:
- 40 computers
- 10 IP phones
- 8 CCTV cameras
- 3 servers
- Guest Wi-Fi
A practical logical design could be:
VLAN 10
OFFICE USERS
192.168.10.0/24
VLAN 20
SERVERS
192.168.20.0/24
VLAN 30
VOICE
192.168.30.0/24
VLAN 40
CCTV
192.168.40.0/24
VLAN 50
GUEST WIFI
192.168.50.0/24
VLAN 99
NETWORK MANAGEMENT
192.168.99.0/24The firewall or Layer 3 switch could then enforce rules such as:
Office → Servers
Allowed as required
Guest → Office
Blocked
Guest → Servers
Blocked
Guest → Internet
Allowed
CCTV → Office
Restricted
Management → Switches/APs
Allowed for administratorsThis demonstrates why VLANs are useful beyond simple traffic organization.
Where 802.1Q Is Commonly Used
802.1Q VLAN tagging appears throughout modern networks:
- Managed Ethernet switches
- Routers
- Firewalls
- Servers
- Hypervisors
- Enterprise Wi-Fi
- IP phones
- CCTV networks
- Data centers
- ISP infrastructure
- Cloud networking
- Virtual machines
- Network appliances
- Storage networks
- Industrial Ethernet
When Should You Use VLANs?
VLANs are particularly useful when you need to:
- Separate departments
- Isolate guest Wi-Fi
- Separate CCTV systems
- Create a voice network
- Isolate servers
- Build management networks
- Segment IoT devices
- Support virtualization
- Reduce Layer 2 broadcast scope
- Apply different firewall policies
- Carry multiple logical networks over shared infrastructure
When VLANs May Be Unnecessary
A very small network containing only a few trusted devices may not need a complex VLAN architecture.
For example:
Router
|
8-port switch
|
5 computersAdding many VLANs can introduce unnecessary administrative complexity if there is no segmentation, security, performance, or operational requirement.
Network design should solve a real problem rather than use VLANs simply because the switch supports them.
802.1Q and 802.1p Summary
The easiest way to remember these technologies is:
Ethernet Frame
|
+---- 802.1Q VLAN ID
| |
| +---- Which VLAN?
|
+---- PCP / 802.1p Priority
|
+---- What Layer 2 priority?For example:
VLAN ID = 30
PCP = 5could conceptually mean:
Traffic belongs to VLAN 30
+
Traffic carries Layer 2 priority value 5The network's QoS policy then decides how that priority marking is treated.
Frequently Asked Questions
What is IEEE 802.1Q?
IEEE 802.1Q is the IEEE standard family for bridges and bridged networks and includes mechanisms used to identify VLAN membership in Ethernet networks through VLAN tagging.
What does 802.1Q tagging do?
It adds VLAN-related information to Ethernet frames so VLAN-aware devices can determine the VLAN associated with the traffic.
How large is an 802.1Q tag?
A standard 802.1Q tag adds 4 bytes.
What is the 802.1Q TPID?
For conventional customer VLAN tagging, the commonly used TPID is:
0x8100
How many bits are used for the VLAN ID?
The VLAN ID field contains:
12 bits
How many normal VLAN IDs are available?
VLAN IDs 1 through 4094 are generally usable for normal VLAN identification, while VID 0 and 4095 have special/reserved meanings.
What is VLAN 0?
VID 0 indicates that the tag does not carry an ordinary VLAN identifier and can be used to convey priority information.
What is IEEE 802.1p?
IEEE 802.1p terminology refers to Layer 2 traffic priority functionality that is now commonly discussed through the PCP field associated with IEEE 802.1Q VLAN tagging.
What is PCP?
PCP means:
Priority Code Point
It is the 3-bit priority field in the VLAN tag.
How many PCP priority levels exist?
There are eight possible PCP values:
0–7
Is PCP 0 normal traffic?
PCP 0 is conventionally associated with Best Effort traffic.
Is PCP 7 always fastest?
No.
PCP 7 represents a high priority value, traditionally associated with network-control traffic, but actual handling depends on the switch's QoS configuration.
Does 802.1p reserve bandwidth?
No.
It provides traffic classification/priority information. Bandwidth scheduling and queue handling depend on QoS configuration.
What is DEI?
DEI means:
Drop Eligible Indicator
It provides information that can be used when deciding which traffic is more eligible to be discarded during congestion.
What is the difference between PCP and DSCP?
PCP provides Layer 2 QoS information in an 802.1Q VLAN tag, whereas DSCP provides Layer 3 QoS information in the IP header.
What is the difference between tagged and untagged traffic?
Tagged traffic contains VLAN tag information. Untagged traffic does not contain an 802.1Q VLAN tag.
Does every computer need VLAN tagging enabled?
No.
Most ordinary computers connected to access-style switch ports send and receive untagged traffic. The switch handles VLAN membership.
Should I enable Priority & VLAN on my Windows NIC?
Only when your network design, switch configuration, driver requirements, or administrator specifically requires endpoint-side VLAN or priority handling.
Randomly enabling it can cause connectivity problems.
What is a PVID?
PVID means Port VLAN Identifier and is commonly used to determine how untagged incoming traffic is classified on a VLAN-aware switch port.
What is a native VLAN?
In vendor implementations using this terminology, the native VLAN is typically the VLAN whose traffic can be carried untagged over a trunk-style link.
Can different VLANs communicate?
Yes, but communication normally requires Layer 3 routing through a router, firewall, or Layer 3 switch.
Are VLANs secure?
VLANs provide useful network segmentation but should not be considered a complete security solution. Firewall rules, ACLs, authentication, endpoint security, and other controls may still be required.
Does a VLAN encrypt traffic?
No.
VLAN tagging provides identification and segmentation, not encryption.
What is QinQ?
QinQ is commonly used to describe VLAN stacking, where an additional VLAN/service tag is used to transport customer VLAN-tagged traffic across another network.
Can Wi-Fi use VLANs?
Yes.
Enterprise wireless access points commonly map different SSIDs to different VLANs.
Can virtual machines use VLANs?
Yes.
Hypervisors and virtual switches commonly use VLAN tagging to place different VMs into different logical networks while sharing physical network interfaces.
Conclusion
IEEE 802.1Q VLAN tagging and IEEE 802.1p-style Layer 2 priority are closely related Ethernet technologies, but they perform different functions.
802.1Q VLAN identification answers:
Which logical Layer 2 network does this frame belong to?
The 12-bit VLAN Identifier makes it possible to distinguish thousands of VLAN identifiers on shared VLAN-aware infrastructure.
PCP/802.1p priority answers:
What Layer 2 priority information is associated with this frame?
Its 3-bit Priority Code Point provides eight possible values from 0 through 7.
Together, these mechanisms allow Ethernet networks to carry information such as:
VLAN membership
+
Traffic priorityUnderstanding them also makes several related networking concepts much easier to understand, including:
- Tagged and untagged ports
- Access and trunk links
- PVID
- Native VLANs
- Voice VLANs
- QoS
- CoS
- PCP
- DSCP
- Inter-VLAN routing
- Router-on-a-stick
- QinQ
- VLAN security
- VLAN troubleshooting
For network administrators, one of the most important practical rules is not to enable VLAN tagging or priority settings simply because a switch or network adapter offers the option. VLAN IDs, tagged/untagged behavior, PVIDs, trunk configuration, endpoint configuration, routing, and QoS policies need to form one consistent network design.
#IEEE8021Q #IEEE8021p #VLAN #VLANTagging #VLANs #Networking #Ethernet #NetworkEngineering #NetworkAdministration #NetworkSecurity #Layer2 #Layer3 #QoS #PCP #PriorityCodePoint #ClassOfService #CoS #DSCP #NetworkPriority #EthernetQoS #TaggedVLAN #UntaggedVLAN #TrunkPort #AccessPort #NativeVLAN #PVID #VLANID #ManagedSwitch #NetworkSwitch #Switching #Routing #InterVLANRouting #RouterOnAStick #VoiceVLAN #VoIP #GuestVLAN #ManagementVLAN #NetworkSegmentation #VLANSecurity #VLANHopping #QinQ #IEEE8021ad #ProviderBridging #WiFiVLAN #ServerNetworking #Virtualization #NetworkTroubleshooting #NetworkTutorial #ITSupport #BisonKnowledgebase
Was this guide useful?
Your answer helps us keep BISONKB accurate and practical.