When looking at this output from an IRB interface:

user@router> monitor traffic interface irb.40 layer2-headers

23:30:40.119357 In <MAC_ADDRESS > Broadcast, ethertype 802.1Q (0x8100), length 56: vlan 2748, p 0, ethertype ARP, arp who-has <IP_ADDRESS> tell <IP_ADDRESS>

23:30:41.225079 In <MAC_ADDRESS > Broadcast, ethertype 802.1Q (0x8100), length 56: vlan 2748, p 0, ethertype ARP, arp who-has <IP_ADDRESS> tell <IP_ADDRESS>

23:30:41.236650 In <MAC_ADDRESS > Broadcast, ethertype 802.1Q (0x8100), length 56: vlan 2748, p 0, ethertype ARP, arp who-has <IP_ADDRESS> tell <IP_ADDRESS>

VLAN 2748 is seen after the length attribute on incoming packets.

VLAN 2748 is seen when monitoring input IRB traffic, but this VLAN isn't configured anywhere.

This is as per AFT Packet-IO design in MPC10 and later. In the AFT based line cards, packets sent to host via IRB interface have the VLAN converted to DUMMY_IRB_VLANID (2748). The Kernel expects packet to contain normalized VLAN tags (number of tags equal to tags configured on bridge), but doesn't care about specific ID's, hence dummy VLAN are added during normalization to avoid various lookups.

2024-03-20 : Article Created

2026-05-27 : Category info is corrected