Two ways into the same lesson. Both cover VLAN segmentation, 802.1Q tagging, inter‑VLAN routing
and the malware containment demo — they differ in how much machine you want between you and the idea.
Mode 02 runs inside this file. Mode 01 opens VLAN-Classic.html — keep it in the same folder.
Druvexaa · Visualise the Invisible
VLAN LAB.
One managed switch. Three departments. Watch a real Ethernet frame pick up its
802.1Q tag on its way out of a tagged trunk — and lose it again
before it reaches a host that was never meant to see it.
Drag to orbit · scroll to zoom · click a workstation or a switch port
802.1Q Segmentation Lab
Switch DX‑2960X · Router‑on‑a‑Stick
VLAN map
VLAN 10 · HR192.168.10.0/24
VLAN 20 · FIN192.168.20.0/24
VLAN 30 · IT192.168.30.0/24
Trunk Gi1/0/48tagged 10,20,30 · native 1
Host
—
—
MAC table
VLAN config
Frame
show mac address-table
VLAN
MAC address
Port
Type
No entries learned yet
Forwarding decision
Idle
show vlan brief
VLAN
Name
Ports
show interfaces switchport
Port
Mode
VLAN
Advanced · native VLAN
Frames belonging to the native VLAN cross the trunk untagged.
Pick VLAN 10 and send HR traffic to see it stay untagged on the trunk.
802.1Q frame inspector
Idle — no traffic on the wire
Lab console · switch syslog + host events
Paceslow
Subtitles
Drag to orbit · scroll to zoom · click any component · double‑click to focus · W A S D to walk
1 / 1
—
—
Containment status · per department
Waiting…
What you're looking at
Nine workstations patch into one 48‑port managed switch. Ports 1–3 sit in VLAN 10, ports 7–9 in VLAN 20, ports 13–15 in VLAN 30. Port 48 is a trunk carrying all three VLANs to a router‑on‑a‑stick.
Watch the frame. On an access port it travels untagged. The switch adds a 4‑byte 802.1Q tag when transmitting the frame on a tagged trunk, and removes it again before transmitting on an access port. The frame object physically grows and shrinks as this happens.
Click a switch port to see whether it is an access port or a trunk, and what that means for tagging.
Turn VLANs off for the lab's fallback mode: every simulated port uses VLAN 1, giving one flat broadcast domain and one flat 192.168.1.0/24 subnet with no tags anywhere. It's a comparison mode, not a rule about real switches.
Turn the ACL off and run the malware demo. VLANs stop layer‑2 flooding, but an open router still forwards between them. Segmentation without a policy is only half a control.