What is PVID?

A PVID (Port VLAN ID) is the VLAN a switch port assigns to untagged frames arriving on it, so every frame belongs to some VLAN inside the switch.

Inside an 802.1Q switch every frame carries a VLAN, but most devices, such as PCs and printers, send ordinary untagged Ethernet frames. When one arrives, the switch places it in the port's PVID. On an access port that is the port's only VLAN: a port with PVID 20 puts everything it receives into VLAN 20, and frames leaving it for VLAN 20 have no tag. On a trunk, which carries several VLANs, tagged frames keep the VLAN in their 802.1Q tag and only untagged frames fall into the PVID. That is the VLAN Cisco calls the native VLAN. On many switches, and on a Linux bridge with VLAN filtering, the default PVID is VLAN 1.

The PVID controls the ingress side; whether frames of that VLAN leave the port tagged or untagged is set separately, so on some platforms you have to configure both, as with the Linux bridge's pvid untagged flags on bridge vlan add. Getting them out of step causes one-way traffic: frames come in on one VLAN but the replies leave on another, or get dropped. A native VLAN or PVID mismatch between the two ends of a trunk is a classic fault, because untagged frames sent in one VLAN arrive in a different one, quietly joining two networks that were meant to be separate. Leaving important traffic untagged on a trunk also opens the door to VLAN-hopping tricks, which is why many designs set the native VLAN to an unused one. See VLAN for the bigger picture, and the Switching basics lesson for access ports and trunks on a real switch.