101 · Question #627
An administrator is performing a capture from a lagged port on an Ethernet SWITCH. Which OSI layer should be inspected to determine with which VLAN a datagram is associated?
The correct answer is B. Data-link layer. IEEE 802.1Q VLAN tags are embedded in the Ethernet frame header at Layer 2 (Data-link layer), making that the correct layer to inspect for VLAN membership.
Question
An administrator is performing a capture from a lagged port on an Ethernet SWITCH. Which OSI layer should be inspected to determine with which VLAN a datagram is associated?
Options
- ANetwork layer
- BData-link layer
- CApplication layer
- DTransport layer
How the community answered
(37 responses)- B92% (34)
- C5% (2)
- D3% (1)
Why each option
IEEE 802.1Q VLAN tags are embedded in the Ethernet frame header at Layer 2 (Data-link layer), making that the correct layer to inspect for VLAN membership.
The Network layer (Layer 3) carries IP addressing information; VLAN membership is a Layer 2 construct and is not visible or encoded at the IP layer.
The 802.1Q standard inserts a 4-byte tag into the Ethernet frame header between the source MAC address and the EtherType field, operating entirely at the Data-link layer (Layer 2). A SPAN or RSPAN capture from a trunk port will include these tags, and only Layer 2 inspection reveals the 12-bit VLAN ID contained within the tag.
The Application layer (Layer 7) contains user data and application protocols and has no awareness of VLAN tags, which are stripped before the frame reaches upper layers.
The Transport layer (Layer 4) handles TCP/UDP port-based segmentation and has no relationship to VLAN tagging, which exists below it in the stack.
Concept tested: IEEE 802.1Q VLAN tagging at Data-link layer
Source: https://www.cisco.com/c/en/us/support/docs/lan-switching/8021q/17056-741-4.html
Topics
Community Discussion
No community discussion yet for this question.