A switched Ethernet network forms a broadcast domain: broadcasts and unknown-destination frames are flooded throughout that domain.

Large flat broadcast domains create unnecessary traffic and weak isolation. Virtual LANs (VLANs) let one physical switching infrastructure contain several logical broadcast domains.

A switch port can be assigned to a VLAN, while links between switches can carry frames from multiple VLANs using a VLAN tag. Devices in different VLANs do not exchange ordinary Ethernet broadcasts directly; traffic between them normally passes through a router or other layer-3 forwarding function.

For example, employee and laboratory devices can share the same switch hardware while belonging to VLAN 10 and VLAN 20. Their local broadcasts remain separated.

A VLAN is therefore a link-layer segmentation mechanism: it changes the logical local network without requiring separate physical switches.