The Switching Questions Every Network Engineer Interview Still Asks — VLANs, STP, and EtherChannel

Most network engineer interview prep leans hard into routing — BGP path selection, OSPF areas, the kind of content that dominates senior-level system design rounds. But switching fundamentals never actually left the interview loop. VLANs, Spanning Tree, and EtherChannel show up constantly, especially in entry-level rounds and in troubleshooting-style questions, and candidates who've spent their prep time entirely on BGP attributes get caught flat-footed by a basic VLAN trunking question they haven't touched since a certification exam.

VLANs: Segmentation, Trunking, and the Native VLAN Gotcha

VLANs exist to solve a specific problem: without them, every device on a physical switch fabric shares one broadcast domain, and broadcast traffic — ARP requests, DHCP discovers — floods every port regardless of whether it's relevant there. VLANs partition a switch fabric into multiple logical broadcast domains on the same physical hardware. The interview-relevant mechanism is 802.1Q tagging: a trunk port carries traffic for multiple VLANs by inserting a 4-byte tag identifying the VLAN into each frame, while an access port carries only one VLAN's untagged traffic. The detail candidates most often get wrong is the native VLAN, the one VLAN on a trunk that's carried untagged by default, and the real security implication: if the native VLAN is misconfigured to differ between two switches on the same trunk, it opens a VLAN hopping path where traffic can cross between VLANs it shouldn't reach.

Why Spanning Tree Exists

Spanning Tree Protocol exists because Ethernet frames have no TTL — a Layer 2 loop, created whenever redundant physical links connect the same set of switches, will circulate frames forever and saturate the fabric within seconds. STP prevents this by electing a root bridge, the switch with the lowest bridge ID, a combination of a configurable priority value and MAC address, and then computing a loop-free tree from every other switch back to that root. Each port ends up in a role: root port, the best path back to the root; designated port, the port responsible for forwarding onto a given segment; and blocking, for the redundant ports STP determined would create a loop if left forwarding.

RSTP's Faster Convergence — and Why Root Placement Still Matters

Classic 802.1D STP converges slowly, 30 to 50 seconds, because it relies on timers rather than active negotiation between switches — a genuinely disruptive gap in a production network. RSTP, 802.1w, fixes this with an explicit proposal-and-agreement handshake between switches that can bring a port to forwarding in seconds rather than tens of seconds, and it adds two port roles classic STP didn't have, alternate, a backup for the root port, and backup, a backup for a designated port, that let a switch fail over locally without waiting for the whole tree to recompute. The reason interviewers still ask about root bridge placement specifically, even though an unoptimized topology will technically still converge and pass traffic, is that a poorly-placed root bridge forces traffic onto longer, suboptimal paths permanently, not just during a failure — the network works, but it's quietly worse than it should be, which is exactly the kind of judgment interviewers are trying to surface.

EtherChannel and LACP: Bundling, Negotiation, and the Hash Gotcha

EtherChannel, and the LACP protocol that negotiates it, bundles multiple physical links between two switches into one logical link, for both aggregate bandwidth and redundancy if one member link fails. LACP negotiates the bundle using active or passive mode on each side, at least one side has to be active for the bundle to form, and a real troubleshooting pattern worth knowing cold is what happens when the negotiated parameters don't match: mismatched speed, duplex, or LACP mode between the two ends leaves the bundle partially formed, with one port showing as bundled and another showing as individual, actively passing traffic on only part of the intended capacity. The other classic gotcha is the load-balancing hash: if a bundle is configured to distribute traffic based on source and destination MAC address alone, and the actual traffic pattern only has a small number of distinct MAC pairs crossing it, most or all of that traffic can hash to a single physical link, meaning an 8-link bundle can still bottleneck on one link's worth of bandwidth despite the aggregate capacity technically being available.

Switching at Datacenter Scale: VXLAN and EVPN

Switching's more senior-level evolution is VXLAN and EVPN, which exist because traditional VLANs cap out at 4,094 IDs and don't cleanly extend across Layer 3 boundaries, both real constraints at datacenter and multi-tenant cloud scale. VXLAN solves the scale problem with a 24-bit segment identifier, roughly sixteen million possible segments, and solves the L3 problem by encapsulating the original Layer 2 frame inside a UDP packet, letting it traverse a routed IP fabric between VTEPs, the tunnel endpoints doing the encapsulation and decapsulation. Plain VXLAN on its own still relies on flood-and-learn to discover where MAC addresses live, the same scaling weakness VLANs have; EVPN replaces that with a BGP-based control plane that distributes MAC and IP reachability information directly, which is why EVPN specifically, not just VXLAN alone, is what shows up in senior data-center networking interviews.

These questions rarely show up as bare definitions — they show up embedded in a scenario: a bonded LACP link with one port stuck "individual," two switches with a VLAN trunking mismatch causing intermittent connectivity, a network that "works" but has an oddly placed root bridge causing unexplained latency on one path. Practise walking through the mechanism out loud for each of these, not just naming it, and practise the specific troubleshooting instinct: what's the first thing you'd check, in order, when a bundle or a trunk isn't behaving as configured. Betty, My Next Hop's AI mock interviewer, and the Routing Lab's diagram-based questions both include this kind of switching-specific scenario, not just the routing content most prep resources default to.