Ethernet Switching and VLANs
This domain covers how switches build forwarding tables, how VLANs segment a LAN, and how Spanning Tree keeps redundant links from melting the network.
MAC learning and forwarding
A switch records the source MAC of every frame and the port it arrived on in its MAC address table. Known unicast is forwarded out the matching port; unknown unicast, broadcast, and multicast are flooded out every port in the VLAN except the ingress port. Entries age out, commonly after 300 seconds.
Spanning Tree
STP (802.1D) elects one root bridge by lowest bridge ID - priority first, then MAC; the default priority is 32768. Redundant ports are blocked to create a loop-free tree. Port states run blocking, listening, learning, forwarding. RSTP (802.1w) converges in seconds. BPDUs are still received on blocked ports.
VLANs and trunking
A VLAN is a broadcast domain configured per switch. Access ports belong to one VLAN and send untagged frames. Trunk ports carry several VLANs using 802.1Q tags: a 4-byte tag with a 12-bit VLAN ID, usable range 1 to 4094. The native VLAN is sent untagged and should be changed from the default VLAN 1 on both ends. Inter-VLAN traffic must be routed, by router subinterfaces (router-on-a-stick) or a Layer 3 switch SVI.
Worked example
A PC in VLAN 10 sends a frame to a PC in VLAN 20 across a trunk. The ingress access port tags it as VLAN 10; the trunk carries it tagged; the far switch forwards it out the VLAN 20 access port and strips the tag. Without a router or SVI, the two PCs cannot communicate even though every link is up.
Traps
Thinking a trunk carries only one VLAN. Mismatched native VLANs leaking untagged traffic between segments. Forgetting that a blocked STP port is still up and still receiving BPDUs. Assuming a Layer 2 switch routes between VLANs.