Aruba Switching Expert (Written) key terms

A logical Layer 2 broadcast domain created on a switch, allowing ports on the same physical hardware or across multiple switches to be grouped as if they were on a separate network segment.

A switch port assigned to exactly one VLAN that sends and receives untagged frames, typically connecting to end devices such as PCs, printers, or servers that do not understand VLAN tags.

A switch port that carries traffic for multiple VLANs simultaneously by tagging frames, commonly used for switch-to-switch links or links to hypervisors and access points.

The IEEE standard for VLAN tagging that inserts a 4-byte tag into the Ethernet frame header, containing a 12-bit VLAN identifier and priority bits used for class-of-service marking.

The single VLAN on an 802.1Q trunk whose frames are transmitted untagged; both ends of the link must agree on it, and mismatches can cause traffic leakage between VLANs.

An attack that lets traffic cross from one VLAN into another, often by double-tagging frames or by abusing a native VLAN mismatch on a trunk link.

The process of moving packets between separate VLAN subnets, performed by a Layer 3 switch using switched virtual interfaces or by a router with one link per VLAN.

A virtual Layer 3 interface on a switch associated with a VLAN, providing an IP address used for management access or as the gateway for hosts in that VLAN.

A design where a single router link carries multiple VLANs as 802.1Q subinterfaces, each acting as the default gateway for one subnet instead of using a Layer 3 switch.

A Layer 2 protocol that prevents forwarding loops by electing a root bridge and blocking redundant ports, producing a loop-free logical topology across bridged networks.

The single switch elected as the logical center of a spanning tree; it has the lowest bridge ID, and all other switches choose their best path toward it.

A value combining a configurable bridge priority and the switch MAC address, used in spanning tree elections; lower values win when comparing switches.

A Layer 2 message exchanged by switches running spanning tree to advertise bridge identity, root path cost, and timers, enabling the election of root and designated ports.

A spanning tree feature that puts an edge port directly into forwarding state, skipping listening and learning delays, for links to end devices that cannot create loops.

A safety feature that error-disables a port configured for edge devices if it receives a BPDU, preventing an unauthorized switch from joining and altering the spanning tree topology.

A spanning tree protection feature that blocks a port from accepting superior BPDUs, keeping an unintended downstream switch from becoming the root bridge.

The IEEE 802.1w evolution of spanning tree that converges in seconds using explicit port roles and proposal-agreement handshakes instead of long timer-based transitions.

An IEEE standard that maps groups of VLANs to independent spanning tree instances, allowing load sharing across redundant links while reducing the number of running tree topologies.

Combining several physical links between two devices into one logical link that increases bandwidth and provides redundancy if a member link fails.

The IEEE 802.3ad/802.1AX protocol that negotiates and monitors link aggregation membership by exchanging control frames, ensuring both ends agree on which links are bundled.

An LACP operating mode in which the local device actively sends control frames to solicit a partner, as opposed to passive mode, which only responds to received frames.

The algorithm that assigns traffic flows to individual members of an aggregated link, hashing header fields such as source and destination MAC or IP addresses.

Connecting multiple physical switches so they operate as one managed entity with a shared control plane, a single configuration, and a unified set of ports.

The elected switch that manages configuration and control for an entire stack, distributing settings to member switches and coordinating their operation.

Any individual physical switch in a stack that is not the commander; it forwards traffic and receives its configuration from the controlling switch.

An Aruba high-availability technology that pairs two switches with independent control planes, synchronizing state over an inter-switch link so either can forward traffic if the other fails.

A link aggregation whose member links terminate on two different switches that coordinate, so a downstream device can bundle links to a redundant pair without spanning tree blocking.

A first-hop redundancy protocol in which routers share a virtual IP and MAC address; the master forwards traffic and a backup takes over if the master fails.

The IP address of the router or Layer 3 switch interface that hosts use to reach destinations outside their own subnet.

A switch or router's list of known destination networks, next hops, and metrics, consulted to decide where each packet should be forwarded.

A manually configured path to a destination network that does not change unless an administrator edits it, often used for simple topologies or as a backup to dynamic routing.

A link-state interior gateway protocol in which routers flood topology information and each computes shortest paths using the Dijkstra algorithm within defined areas.

A switch security feature that inspects DHCP messages, trusts only authorized server ports, and builds a binding table of client IP and MAC assignments used by other protections.

A security feature that validates ARP packets against the DHCP snooping binding table and drops forged replies, mitigating man-in-the-middle attacks on the local segment.

A feature that limits which and how many MAC addresses may appear on a switch port, taking a configured action such as shutting down the port when a violation occurs.

An IEEE standard for port-based network access control that authenticates a supplicant through an authenticator switch and a RADIUS server before granting network access.

A widely used protocol for centralized authentication, authorization, and accounting, where a network device forwards user credentials to a central server for a decision.

An access-control method that grants or denies network access based on a device's MAC address, often checked against a RADIUS server for devices that cannot run 802.1X supplicants.

A switch feature that listens to IGMP messages between hosts and routers and uses them to forward multicast frames only to ports that requested the group.

The protocol hosts use to tell routers and switches which multicast groups they want to receive, enabling group membership tracking on a network segment.

A logical set of receivers identified by a single multicast IP address, so one transmitted packet is delivered to all members that have joined that group.

A set of mechanisms that classify, mark, queue, and schedule traffic so latency-sensitive or business-critical flows receive preferential treatment during congestion.

A 6-bit field in the IP header used to mark packets with a per-hop behavior class, letting devices apply consistent queuing and drop treatment across the network.

A technique that buffers and delays excess traffic to smooth bursts and keep output within a configured rate, unlike policing, which drops or remarks traffic that exceeds the rate.

A safeguard that monitors broadcast, multicast, or unknown unicast rates on a port and blocks or limits traffic when a configured threshold is exceeded.

A standard protocol for polling and receiving traps from network devices, letting a management station read status data and collect alerts from switches.

A logging standard that sends event messages from network devices to a central collector, where they can be stored, searched, and used for alerting.

A sampling technology that captures packet headers and interface counters on a device and exports them to a collector for traffic analysis and monitoring.

A vendor-neutral protocol that devices use to advertise identity, port, and capability information to directly connected neighbors, aiding topology discovery and troubleshooting.

A proprietary neighbor-discovery protocol that shares device and port details with directly connected devices, useful for mapping topology but limited to one vendor's equipment.