Ethernet Switching and Virtual LANs

Introduction and Context

Ethernet is the dominant technology for local area networks (LANs). Early Ethernet networks connected devices through shared coaxial cable or hubs, so all devices competed for the same transmission medium. Modern Ethernet LANs normally use switches. A switch receives Ethernet frames, examines their destination Media Access Control (MAC) addresses, and forwards frames through appropriate ports. This improves performance, reduces unnecessary traffic, and supports logical segmentation through Virtual LANs (VLANs).

This chapter develops the operational knowledge required to design and configure switched networks. It explains MAC addressing, frame forwarding, collision and broadcast domains, VLANs, trunk links, inter-VLAN routing, link aggregation, Power over Ethernet (PoE), and the Spanning Tree Protocol (STP). Examples use common enterprise-switch terminology; exact commands vary between vendors.

Learning Objectives

By the end of this chapter, you should be able to:

• Explain Ethernet MAC addresses and frame structure.
• Describe how a switch learns, filters, forwards, floods, and ages MAC entries.
• Distinguish collision domains from broadcast domains.
• Configure access ports, VLANs, trunks, and inter-VLAN connectivity.
• Explain link aggregation and PoE operation.
• Describe how STP prevents Layer 2 loops.
• Select suitable designs and troubleshoot common switching faults.

1. Ethernet Frames and MAC Addressing

An Ethernet frame is the Layer 2 unit transported across an Ethernet link. A conventional Ethernet frame contains a destination MAC address, source MAC address, optional 802.1Q VLAN tag, EtherType or length field, payload, and Frame Check Sequence (FCS). The preamble and Start Frame Delimiter assist physical-layer synchronization but are normally not treated as part of the frame delivered to the network layer.

A MAC address is normally 48 bits, written as six hexadecimal octets, for example, 00:1A:2B:3C:4D:5E. The first 24 bits are commonly called the Organizationally Unique Identifier (OUI), while the remaining bits identify an interface assigned by the manufacturer or administrator. The address is not necessarily a permanent identity: modern operating systems may randomize wireless MAC addresses, and administrators can configure locally administered addresses.

The least significant bit of the first octet indicates whether an address is individual or group-oriented. A value of 0 indicates an individual (unicast) address; 1 indicates a group address. The second least significant bit indicates globally administered versus locally administered addressing. The broadcast address is FF:FF:FF:FF:FF:FF; it is a special group address delivered to all stations in the local broadcast domain.

An Ethernet switch maintains a Content Addressable Memory (CAM) table, also called a MAC address table. A typical entry associates a VLAN, a MAC address, and a switch port. The VLAN association is essential because the same MAC address can legitimately appear in different isolated VLANs.

2. How a Switch Forwards Frames

When a frame enters a switch, the switch performs the following logical sequence:

1. It checks the frame sufficiently to identify its ingress port and VLAN.
2. It learns the source MAC address by associating it with the ingress port and VLAN.
3. It examines the destination MAC address.
4. It forwards, filters, or floods the frame.
5. It eventually removes inactive entries through aging.

If the destination is known in the same VLAN, the switch forwards the frame only through the associated egress port. If the destination is known to be on the ingress port, the switch filters the frame rather than sending it back. If the destination is unknown, the switch floods the frame out all other ports in that VLAN. Broadcast frames and many multicast frames are also flooded, subject to switch features such as multicast control.

A switch does not normally inspect the IP address to make ordinary Layer 2 forwarding decisions. A multilayer switch can additionally route IP packets, but switching and routing remain conceptually distinct operations.

Example of Learning and Forwarding

Suppose PC-A sends a frame to PC-B through a switch. Initially, the table contains neither address. The switch learns PC-A's source address on port 1. Because PC-B is unknown, it floods the frame to other ports in the same VLAN. PC-B replies. The switch learns PC-B on, for example, port 4. Subsequent frames between the two PCs are forwarded only between ports 1 and 4, provided the entries remain valid.

A topology change, device movement, virtual-machine migration, or spoofed frame may cause a MAC address to appear on a different port. The switch updates the table, which is why a table is better understood as a learned forwarding cache than as a permanent database.

3. Collision Domains and Broadcast Domains

A collision occurs when two devices transmit simultaneously on a shared half-duplex medium. A traditional hub creates one collision domain because all connected devices share the same medium. A switch normally creates one collision domain per active port, particularly when links operate in full-duplex mode. Full-duplex Ethernet eliminates collisions on that point-to-point link; it does not eliminate broadcasts.

A broadcast domain is the set of devices that receive a Layer 2 broadcast. Without VLANs, all ports in a switched LAN may belong to one broadcast domain. A router or Layer 3 interface separates broadcast domains. Each VLAN is also a separate broadcast domain because broadcasts are confined to that VLAN unless a Layer 3 device forwards selected traffic.

Large broadcast domains may produce unnecessary traffic and difficult fault isolation. Excessive broadcasts can also consume endpoint and switch resources. VLANs provide logical separation, but they do not replace appropriate IP addressing, routing policy, or security controls.

4. VLAN Concepts and 802.1Q Tagging

A Virtual LAN is a logical Layer 2 network implemented across one or more physical switches. Devices in different VLANs are separated even when connected to the same switch. A VLAN is identified by a VLAN ID (VID), normally in the range 1–4094 for standard usable VLAN identifiers; exact reserved values and platform behavior must be checked in the vendor documentation.

An access port carries traffic for one VLAN and normally connects to an endpoint such as a computer, printer, or IP phone. Frames transmitted to an ordinary endpoint are usually untagged. The switch internally associates those frames with the configured access VLAN.

A trunk port carries traffic for multiple VLANs between switches, or between a switch and a router or multilayer switch. IEEE 802.1Q inserts a VLAN tag into the frame. The tag includes a VID and priority-related fields. The receiving device uses the tag to preserve VLAN identity across the trunk. A native VLAN may carry untagged frames on some trunk configurations. Native VLAN choices must match at both ends and should be deliberately controlled.

A trunk should normally restrict its allowed VLAN list to only the VLANs required by the design. This reduces broadcast propagation and limits the impact of configuration errors. Dynamic trunk negotiation, where available, should be disabled or tightly controlled on ports that should not negotiate trunking.

Conceptual VLAN Topology

Figure: Access ports assign endpoints to VLANs, while the trunk preserves multiple VLAN identities between switches.

5. Basic Switch Configuration

A professional configuration process begins with a design rather than command entry. Record VLAN numbers, names, subnets, access ports, trunk endpoints, management addresses, and security requirements. A generic configuration sequence is:

1. Set a hostname, management credentials, time source, and configuration backup method.
2. Create and name the required VLANs.
3. Assign endpoint ports as access ports and place them in the correct VLAN.
4. Configure switch-to-switch links as trunks.
5. Restrict permitted VLANs and define native VLAN behavior.
6. Configure management access through a dedicated management VLAN or management network.
7. Verify with MAC-table, VLAN, trunk, interface, and spanning-tree commands.

Vendor-neutral pseudoconfiguration might be represented as:

create vlan 10 name STAFF
create vlan 20 name STUDENTS
interface ports 1-12
  mode access
  access-vlan 10
interface ports 13-20
  mode access
  access-vlan 20
interface port 24
  mode trunk
  allowed-vlans 10,20,99
  native-vlan 99

The syntax is illustrative, not a command set for a particular manufacturer. On real equipment, verify whether a command changes the running configuration, startup configuration, or both.

6. Inter-VLAN Connectivity

VLANs intentionally prevent direct Layer 2 communication between one another. If a workstation in VLAN 10 must communicate with a server in VLAN 20, a Layer 3 device must route the traffic. The default gateway for each VLAN is normally a routed interface in that VLAN.

Two common designs are:

• Router-on-a-stick: one physical router interface uses multiple 802.1Q subinterfaces. Each subinterface has an IP address and VLAN identifier. The switch-to-router link is a trunk.
• Multilayer switch: a switch creates Switched Virtual Interfaces (SVIs), one per VLAN, and enables IP routing. This generally provides higher performance and simpler campus scaling.

Example addressing plan:

The addresses above use documentation ranges and are illustrative. Hosts in different IP subnets send frames to their default gateway; the router or multilayer switch then makes a Layer 3 forwarding decision. Routing enables reachability, but access control lists, firewall policies, and identity controls determine whether that reachability should be allowed.

7. Link Aggregation

Link aggregation combines multiple physical Ethernet links into one logical bundle. Common standards include IEEE 802.1AX Link Aggregation and the Link Aggregation Control Protocol (LACP). Benefits include increased aggregate capacity, redundancy, and simplified logical topology.

A bundle generally requires matching speed and duplex settings, compatible VLAN/trunk parameters, and consistent administrative policies. Traffic is usually distributed by a hash based on fields such as source and destination MAC addresses, IP addresses, or transport ports. Consequently, one individual flow may use only one physical member; four links do not necessarily make one file transfer four times faster.

LACP can operate in active or passive modes. At least one side must actively initiate negotiation; active-active is commonly chosen for predictable operation. Static aggregation lacks negotiation and can create severe loops if the physical members do not match.

8. Power over Ethernet

PoE allows a switch or injector to provide electrical power over twisted-pair Ethernet cabling while carrying data. It supports devices such as wireless access points, IP phones, cameras, sensors, and access-control equipment. IEEE standards include 802.3af (PoE), 802.3at (PoE+), and 802.3bt (higher-power PoE classes). Exact available power depends on the standard, switch budget, cable conditions, port classification, and vendor implementation.

A PoE system performs detection before applying full power. Classification allows the powered device and power-sourcing equipment to negotiate or identify a suitable power class. Designers must calculate the total power budget, including startup and worst-case consumption, and must account for redundancy and environmental conditions. Poor-quality cabling, excessive length, damaged pairs, and overloaded switch supplies can cause intermittent failures.

PoE should be treated as infrastructure power, not as an unlimited source. Critical deployments should document electrical protection, UPS coverage, grounding, thermal conditions, and emergency shutdown procedures.

9. Spanning Tree Protocol and Loop Prevention

Redundant Layer 2 links improve availability but can create loops. A frame without a usable time-to-live field at Layer 2 can circulate indefinitely. Loops cause broadcast storms, repeated frame duplication, unstable MAC learning, and high CPU utilization. STP creates a loop-free logical topology while retaining redundant links in a blocked or alternate state.

The classical IEEE 802.1D process elects a root bridge. The bridge with the lowest Bridge ID wins. Bridge ID is determined by bridge priority and MAC address, with the lower value preferred. Each non-root switch selects a root port: the port with the best path toward the root. On each network segment, a designated port provides the best path away from the root. Other redundant paths are placed into a non-forwarding state.

Rapid Spanning Tree Protocol (RSTP), standardized in IEEE 802.1w and incorporated into later bridging standards, improves convergence. Multiple Spanning Tree Protocol (MSTP) maps groups of VLANs to spanning-tree instances, reducing control overhead while allowing carefully planned load distribution.

Important protections include:

• PortFast or edge mode: accelerates an endpoint port to forwarding; never use it indiscriminately on switch-to-switch links.
• BPDU Guard: disables an edge port if a Bridge Protocol Data Unit appears, protecting against an unauthorized switch.
• Root Guard: prevents a designated port from accepting a superior root claim.
• Loop Guard: helps prevent an unexpected loss of BPDUs from causing an alternate port to forward incorrectly.
• Broadcast storm control: limits excessive broadcast, multicast, or unknown-unicast traffic.

STP is a safety mechanism, not a substitute for sound topology. A deliberate root placement, consistent bridge priorities, documented redundant paths, and monitoring are essential.

10. Worked Design Example

An organization has two access switches. Staff workstations use VLAN 10, student systems use VLAN 20, and network management uses VLAN 99. Each switch connects to the other through two physical links. A multilayer switch provides inter-VLAN routing.

The design approach is as follows:

1. Create VLANs 10, 20, and 99 on both switches.
2. Configure endpoint ports as access ports in VLAN 10 or 20.
3. Combine the two inter-switch links into one LACP trunk bundle.
4. Permit only VLANs 10, 20, and 99 on the bundle.
5. Configure SVIs on the multilayer switch with the documented gateway addresses.
6. Make the multilayer switch the intended STP root for these VLANs or instances.
7. Enable edge mode only on genuine endpoint ports and apply BPDU Guard.
8. Verify that both switches agree on VLAN existence, trunk state, native VLAN, allowed VLANs, LACP membership, and STP roles.

If a staff workstation cannot reach a student server, troubleshooting should proceed layer by layer: verify link status and cabling; confirm the workstation's access VLAN; inspect the MAC table; verify trunk allowance; check the SVI and default gateway; inspect routing and access-control policies; and test return traffic. This sequence avoids changing several variables at once.

11. Illustrative Case Study: Campus Network Segmentation

Background

A small college originally used one flat switched LAN for staff, students, IP phones, wireless access points, and network administration. Users experienced slow periods, and a loop caused a broadcast storm when an unmanaged switch was connected in a classroom.

Problem Analysis

The flat design created one large broadcast domain. There was no consistent separation between endpoint types, and access switches had redundant links without a verified loop-prevention policy. Management interfaces were reachable from ordinary user ports. PoE capacity was also insufficient for new wireless access points.

Approach and Solution

The network team introduced separate VLANs for staff, students, voice, wireless clients, guests, and management. Access ports were assigned according to endpoint function. Uplinks were configured as restricted LACP trunks. A multilayer switch supplied SVIs and policy-controlled inter-VLAN routing. RSTP was enabled, the core was selected as root, and edge ports received BPDU Guard. PoE switch budgets were measured against the maximum expected access-point and phone load. Guest traffic was routed to an isolated firewall segment rather than internal networks.

Outcome

Broadcast traffic became more predictable, the classroom loop was contained by edge protection, and management access was limited to authorized administration networks. The design also made faults easier to localize. However, VLANs alone did not provide complete security: firewall rules, endpoint authentication, switch hardening, logging, and regular review remained necessary.

Learning Points

Good switching design combines segmentation, redundancy, loop prevention, capacity planning, and governance. Configuration consistency is as important as the individual features. A technically correct VLAN plan can still fail if trunks are misconfigured, native VLANs disagree, or routing policy is absent.

12. Challenges, Security, and Best Practices

Switches can be attacked through MAC flooding, rogue DHCP servers, VLAN hopping, ARP spoofing, unauthorized trunk formation, and physical tampering. Useful controls include secure management protocols such as SSH, strong authentication, dedicated management networks, port security where appropriate, DHCP snooping, Dynamic ARP Inspection, IP Source Guard, storm control, disabled unused ports, and configuration backups.

Port security must be deployed carefully. Restricting learned MAC addresses can prevent unauthorized devices, but it may disrupt legitimate virtual machines, phones, or endpoint replacement. Security controls should therefore be matched to the operational environment and documented.

Best practices include:

• Use a clear VLAN and IP addressing plan.
• Avoid using the default VLAN for ordinary users or management where the platform and policy permit.
• Restrict trunk VLANs and disable unnecessary negotiation.
• Match trunk, native VLAN, speed, duplex, and aggregation settings at both ends.
• Place STP root roles deliberately rather than accepting accidental election.
• Apply edge protections only to true edge ports.
• Monitor interface errors, broadcasts, MAC moves, PoE consumption, and STP events.
• Keep firmware current and maintain tested configuration backups.
• Document physical labels, logical roles, and change approvals.

13. Contemporary Developments

Modern data centers increasingly use overlay technologies, software-defined networking, and automated configuration systems to scale beyond traditional campus VLAN designs. VXLAN, for example, can extend Layer 2 semantics over a routed IP underlay, while controllers provide centralized policy and telemetry. These technologies do not remove the need to understand Ethernet switching: physical access networks, endpoint attachment, MTU planning, routing, and loop avoidance remain foundational.

Automation can validate VLAN consistency, detect configuration drift, and generate switch configurations. It must be governed through version control, testing, least privilege, approval processes, and rollback plans. Artificial intelligence may assist anomaly detection or troubleshooting, but generated recommendations require verification against topology, device state, and security policy.

Chapter Summary

Ethernet switches learn source MAC addresses and use destination MAC addresses to forward frames within VLANs. Unknown unicast, broadcast, and selected multicast traffic may be flooded within the relevant broadcast domain. Switch ports normally form separate collision domains, while VLANs divide broadcast domains. Access ports connect endpoints to one VLAN; 802.1Q trunks carry multiple VLANs between network devices. Communication between VLANs requires routing through a router or multilayer switch.

Link aggregation provides logical bundles of physical links and can improve resilience and aggregate capacity when configured consistently. PoE supplies power to network devices but requires careful power-budget and cabling analysis. STP and its faster or scalable variants prevent Layer 2 loops by constructing a loop-free logical topology. Effective professional practice combines correct configuration with security controls, monitoring, documentation, and controlled change management.

Key Terms

MAC address: A Layer 2 hardware or logical interface identifier used in Ethernet forwarding.

Ethernet frame: The Layer 2 data unit transmitted over an Ethernet network.

CAM table: A switch table associating MAC addresses and VLANs with ports.

Unicast: Traffic addressed to one destination.

Broadcast: Traffic addressed to all devices in a broadcast domain.

Collision domain: A set of devices that could contend for the same shared medium.

Broadcast domain: Devices that receive a Layer 2 broadcast.

VLAN: A logical Layer 2 network implemented across physical switching infrastructure.

Access port: A switch port assigned to one VLAN for endpoint connection.

Trunk: A link carrying traffic for multiple VLANs.

802.1Q: IEEE VLAN-tagging standard used on Ethernet trunks.

Native VLAN: The VLAN associated with untagged traffic on a trunk.

SVI: A switch virtual interface providing a Layer 3 interface for a VLAN.

Inter-VLAN routing: Layer 3 forwarding between different VLANs.

LACP: A protocol for negotiating and managing link aggregation.

PoE: Delivery of electrical power over Ethernet cabling.

STP: A protocol that prevents Layer 2 loops.

Root bridge: The reference switch selected by STP for path calculation.

BPDU Guard: A protection that disables an edge port receiving an STP BPDU.

Broadcast storm: Excessive repeated broadcast or related Layer 2 traffic caused by faults such as loops.

Review Questions

Short Answer Questions

1. What information does a switch learn from the source address of an incoming Ethernet frame?
2. Distinguish a collision domain from a broadcast domain.
3. What is the difference between an access port and a trunk port?
4. Why is a Layer 3 device required for communication between VLANs?
5. State two purposes of STP.

Long Answer Questions

1. Explain the complete process a switch follows when receiving a frame with a known destination, an unknown destination, and a broadcast destination.
2. Describe how 802.1Q tagging allows multiple VLANs to cross a trunk link.
3. Compare router-on-a-stick with multilayer-switch inter-VLAN routing.
4. Explain the benefits and limitations of LACP link aggregation.
5. Describe STP root-bridge election, root ports, designated ports, and redundant paths.

Analytical / Application Questions

1. Two switches are connected by a trunk, but VLAN 20 hosts on different switches cannot communicate while VLAN 10 hosts can. Identify a structured troubleshooting sequence and likely causes.
2. Design a VLAN, trunk, routing, PoE, and STP plan for a three-floor college building containing staff computers, student laboratories, IP phones, wireless access points, guests, and network-management devices.
3. A network experiences rapidly changing MAC-table entries, duplicated broadcasts, and high switch CPU usage after a new cable is installed. Analyze the likely fault and explain the corrective and preventive measures.

Multiple Choice Questions with Answers

Question 1

Which address does an Ethernet switch normally use for a standard Layer 2 forwarding decision?

A. Destination MAC address

B. Source IP address

C. Destination port number

D. DNS name

Correct Answer: A. Destination MAC address

Question 2

What happens when a switch receives a frame with an unknown unicast destination?

A. It discards the frame immediately

B. It floods the frame within the relevant VLAN

C. It routes the frame to every VLAN

D. It sends the frame only to the management port

Correct Answer: B. It floods the frame within the relevant VLAN

Question 3

Which configuration normally connects an endpoint to a single VLAN?

A. Access port

B. Trunk port

C. Root port

D. Routed port-channel only

Correct Answer: A. Access port

Question 4

What is the principal purpose of an 802.1Q trunk?

A. To carry multiple VLANs across one link

B. To convert MAC addresses into IP addresses

C. To eliminate the need for routing

D. To supply electrical power only

Correct Answer: A. To carry multiple VLANs across one link

Question 5

Which device function enables communication between VLAN 10 and VLAN 20?

A. Layer 3 routing

B. MAC aging alone

C. Port mirroring

D. Broadcast flooding

Correct Answer: A. Layer 3 routing

Question 6

What is a major benefit of LACP link aggregation?

A. It makes every individual flow use every physical link simultaneously

B. It combines compatible physical links into one logical bundle

C. It removes the need for VLAN configuration

D. It prevents all IP-layer failures

Correct Answer: B. It combines compatible physical links into one logical bundle

Question 7

What does PoE provide over suitable Ethernet cabling?

A. Electrical power as well as data

B. Only encrypted management traffic

C. A second IP address for each host

D. Automatic inter-VLAN routing

Correct Answer: A. Electrical power as well as data

Question 8

What problem is STP primarily designed to prevent?

A. Layer 2 switching loops

B. Incorrect DNS records

C. Low wireless signal strength

D. IP address exhaustion

Correct Answer: A. Layer 2 switching loops

Question 9

Which protection is particularly suitable for detecting a BPDU on a port intended only for an endpoint?

A. BPDU Guard

B. LACP passive mode

C. Native VLAN tagging

D. MAC address aging

Correct Answer: A. BPDU Guard

Question 10

A switch port belongs to VLAN 10, but VLAN 10 is not allowed on the inter-switch trunk. What is the most likely result?

A. Traffic from VLAN 10 will not cross that trunk

B. Traffic will automatically move to VLAN 20

C. The switch will route VLAN 10 through every access port

D. STP will convert VLAN 10 into the native VLAN

Correct Answer: A. Traffic from VLAN 10 will not cross that trunk