A trunk port is a switch port configured to carry traffic for multiple VLANs over a single physical or aggregated link, keeping the VLANs separate by adding an IEEE 802.1Q tag to each frame. In Ethernet & switching, trunk ports connect switches to each other, to routers, firewalls, wireless access points and virtualization hosts, wherever more than one VLAN must cross the same cable.
The opposite of a trunk port is an access port, which belongs to exactly one VLAN and sends untagged frames to an end device such as a PC or printer. Without trunks, every VLAN would need its own cable between switches, so trunking is what makes VLAN-based network segmentation practical at scale.
How a trunk port carries several VLANs
When a frame leaves a trunk port, the switch inserts a 4-byte 802.1Q tag between the source MAC address and the EtherType field. The tag contains a 12-bit VLAN ID, allowing values from 1 to 4094, and a 3-bit priority code point used for Layer 2 quality of service. The receiving switch reads the tag, places the frame in the matching VLAN and strips the tag before delivering it to an access port.
| Field | Size | Purpose |
|---|---|---|
| TPID | 16 bits, value 0x8100 | Identifies the frame as tagged |
| PCP | 3 bits | Priority from 0 to 7 for QoS |
| DEI | 1 bit | Marks frames eligible to drop under congestion |
| VLAN ID | 12 bits | VLAN 1 to 4094; 0 and 4095 reserved |
The tag increases the maximum frame size from 1518 to 1522 bytes. Standards-compliant equipment accepts this automatically, but older or misconfigured devices in the path may drop these slightly oversized frames, which shows up as intermittent loss of large packets.
Native VLAN and allowed VLAN lists
Each 802.1Q trunk has one native VLAN whose frames are sent untagged. Any untagged frame arriving on the trunk is placed into that VLAN. The native VLAN exists for compatibility with devices that do not understand tags, and it must match on both ends of the link, otherwise traffic leaks between VLANs.
The allowed VLAN list restricts which VLANs may cross the trunk. Many switches allow all VLANs by default, which floods broadcast traffic from every VLAN across every trunk. Pruning the list to only the VLANs actually needed on the far side reduces unnecessary traffic and limits the reach of broadcast storms and misconfigurations.
| Setting | Common default | Recommended practice |
|---|---|---|
| Encapsulation | 802.1Q | Use 802.1Q; ISL is obsolete |
| Native VLAN | VLAN 1 | Change to an unused VLAN or tag it |
| Allowed VLANs | All, 1-4094 | Explicit list of required VLANs |
| Negotiation | Dynamic on some vendors | Disable and set trunk mode statically |
| MTU | 1500 payload | Increase on all links if jumbo frames are used |
Trunk port compared with access ports and related features
Trunk ports are easily confused with other technologies that combine or carry traffic across links. The comparison below separates the concepts that operate alongside trunking in switched networks.
| Concept | What it does | Relation to trunking |
|---|---|---|
| Access port | Carries one VLAN, untagged | Endpoint side of a VLAN |
| Hybrid port | One untagged VLAN plus tagged VLANs | Common for IP phones with a PC behind them |
| Link aggregation | Bundles links into one logical link | A bundle can itself be a trunk |
| VLAN tagging | The 802.1Q mechanism itself | What a trunk port applies |
| VXLAN | Carries Layer 2 segments over IP | Extends VLANs beyond Layer 2 trunks |
Vendor vocabulary adds confusion: on some platforms a trunk means a link aggregation group, not a VLAN trunk, while those platforms describe VLAN trunks as tagged ports. Reading the documentation of the specific switch is essential before applying a configuration copied from another vendor.
Where trunk ports are used
A trunk is needed on any link that must transport more than one VLAN. In a typical campus, access switches connect to distribution or core switches over trunks, and the core performs routing between VLANs. The table lists the most common placements.
| Link | VLANs carried | Reason |
|---|---|---|
| Switch to switch uplink | All user, voice and management VLANs | Extend VLANs across the building |
| Switch to router or firewall | All routed VLANs | Router on a stick inter-VLAN routing |
| Switch to wireless access point | One VLAN per SSID plus management | Map SSIDs to separate networks |
| Switch to hypervisor host | VLANs used by virtual machines | Virtual switch assigns VLANs to guests |
In the router on a stick design, a single router interface with one subinterface per VLAN routes between all VLANs over one trunk. It is simple and inexpensive, but the trunk becomes a bottleneck for inter-VLAN traffic, so larger networks route on Layer 3 switches instead.
Security risks and configuration mistakes
Trunk ports are a frequent target in Layer 2 attacks because they carry many networks at once. Two classic techniques exploit default settings rather than software flaws.
- Switch spoofing: an attacker’s device negotiates a trunk through dynamic trunking protocols and gains access to all VLANs. Defense: disable negotiation and set user ports to access mode.
- Double tagging: a frame with two tags, sent from the native VLAN, crosses into another VLAN after the first switch strips the outer tag. Defense: use an unused native VLAN or tag the native VLAN.
- Native VLAN mismatch: different native VLANs on each end merge two VLANs silently.
- Over-permissive allowed lists: VLANs reach switches where they are not needed, widening exposure.
Spanning Tree Protocol interacts with trunks too: in per-VLAN spanning tree variants, each VLAN has its own topology on the trunk, so a blocked VLAN on one trunk may still forward others. Verifying trunk state with commands that show operational mode, native VLAN and active VLANs catches most mistakes before they affect users.
The idea in brief
Imagine a building where several companies share one elevator shaft. Each passenger wears a colored badge showing which company they belong to. At each floor, only people with the right badge get out. The shaft is shared, but the companies stay separate.
A trunk port is that shared shaft for network traffic. Several separate networks, called VLANs, travel over one cable between switches. Each piece of data carries a small tag with its VLAN number, so the receiving switch knows exactly where it belongs.
A practical scenario
A three-story office uses separate VLANs for staff computers (VLAN 10), IP phones (VLAN 20), guest Wi-Fi (VLAN 30) and device management (VLAN 99). Each floor has an access switch connected to a core switch by a 10 Gb/s trunk that allows only VLANs 10, 20, 30 and 99. The native VLAN is set to unused VLAN 999, and trunk negotiation is disabled on every port.
Ceiling-mounted access points connect to trunk ports carrying VLANs 30 and 99, so guest traffic is isolated from staff traffic from the moment it enters the network. When a visitor later plugs a laptop into a conference room wall socket, the port is an access port in the guest VLAN, and the laptop cannot negotiate a trunk or reach any internal network.