In any extensive network, data must be forwarded efficiently from a source device to its intended destination without congesting the entire system. This intelligent routing of data frames at the Data Link Layer is known as switching.

A network switch is an intelligent device that receives incoming data frames and strictly forwards them only to the specific port where the destination device is connected. This is vastly superior to older hub devices, which blindly broadcast data to every single connected device.

A switch relies on hardware MAC addresses to make intelligent forwarding decisions. It actively builds a MAC address table that maps every connected device's MAC address to its specific physical port on the switch.

When redundant switches are connected to prevent complete network failures, they can accidentally create infinite routing loops known as broadcast storms. The Spanning Tree Protocol automatically detects these physical loops and mathematically blocks certain ports to create a loop free logical topology.

A Virtual LAN is a logical grouping of networking devices that acts as if they are connected to the exact same physical network, regardless of their actual physical location.

Without VLANs, every device on a switch receives all broadcast traffic. As a network scales, this broadcast traffic consumes massive amounts of bandwidth. VLANs solve this by logically dividing a single physical switch into multiple isolated broadcast domains.

When VLANs span across multiple physical switches, the switches must be able to identify which VLAN a traveling frame belongs to. This is accomplished using the IEEE 802.1Q standard, which inserts a strict VLAN ID tag into the frame.

Because each VLAN is a completely isolated broadcast domain, devices in different VLANs cannot natively speak to one another. To permit communication between two separate VLANs, a Layer 3 routing device must be used to inspect the IP addresses and securely route the traffic between them.