What Is a VLAN, Actually? (No Jargon)

Here's a definition of VLAN you've probably already read somewhere: "a Virtual Local Area Network logically segments a physical network into multiple broadcast domains." Technically correct. Almost completely useless if you don't already know what a broadcast domain is, which is the whole problem with how this topic usually gets taught.

Let's start from the actual problem VLANs solve, and the jargon will make sense on the way there instead of before it.

The problem: everyone's shouting in one room

Imagine every device on a network — laptops, printers, phones, smart TVs — is a person standing in one giant room. When any device wants to find another device on the same network for the first time, it doesn't whisper directly to it. It shouts to the whole room: "Who has this address?" Every single device in that room hears the shout, even though the message was only meant for one of them.

That shout is called a broadcast, and the entire room of devices that hears it is called a broadcast domain. A small room is fine. A room with thousands of devices in it means constant background noise — and it means that if one device in the room is compromised or misbehaving, it can potentially see or interfere with everyone else in the same room, because they're all in earshot of each other.

The fix: build walls, not new buildings

The obvious answer would be to give every department its own physical switch and its own physical cabling — its own separate building, essentially. That works, but it's expensive and rigid. Every time someone changes team or desk, you're re-running cables.

A VLAN is what happens when you take that one big open-plan room and put up internal walls, without constructing a new building. Physically, it's still one switch and one set of cables. Logically, the switch is configured to treat different groups of ports as if they were in entirely separate rooms. A device plugged into a "Finance" VLAN port shouts, and only the other "Finance" devices hear it — even if the "Engineering" VLAN is running through the exact same physical switch, one rack unit away.

Why anyone bothers doing this

• Security: a compromised device on one VLAN can't freely reach devices on another VLAN without going through a router or firewall first — which gives you a checkpoint to control and monitor that traffic.
• Noise reduction: smaller broadcast domains mean less background shouting, which means better performance at scale.
• Organisation: you can group devices by function (guest Wi-Fi, staff laptops, security cameras, VoIP phones) rather than by which physical port they happen to be plugged into.

The one extra word: trunking

You might wonder: if VLAN traffic is walled off, how does it get from one switch to another switch elsewhere in the building without spilling everything together? The answer is a trunk port — a connection between switches that's allowed to carry traffic from multiple VLANs at once, with each frame "tagged" with a label saying which VLAN it belongs to. It's less important to memorise the mechanism right now than to know the word exists, so it doesn't blindside you later.

Try it yourself, at home, for free

You don't need enterprise gear to see this in action. Most consumer routers and mesh systems now offer a "guest network" toggle — turn it on, and you've just created a simple VLAN-style separation. Your guest's phone can get to the internet, but it can't see your NAS, your smart plugs, or your work laptop sitting on the main network. That's the exact same principle, in miniature, that a company uses to keep its finance servers away from its guest Wi-Fi.

If you want to go one step further, a cheap managed switch (even a second-hand one) will let you create two or three VLANs manually and watch, with a packet capture tool, how devices on one VLAN genuinely cannot see broadcast traffic from the other. Seeing it fail to cross over is a much better teacher than any diagram.