GE JungleMUX SONET Technical Practice page 158

unit it is referred to as PVLAN. Frames ingressing one port will therefore only
egress "edge" ports configured with the same (D-)PVLAN ID.
All the broadcast, unknown-DA, and remote-DA frames will egress the switches‟
"trunk" ports with these "tags" intact allowing the same "filtering" to occur at all
the switches in the network.
Note that with such a port-based VLAN network, it is impossible for a hacker to
launch frames into the other D-PVLANs, or to eavesdrop on traffic in other D-
PVLANs; this is a very attractive security feature.
Note that in order for such a network to be transparent for the traffic connected to
the switches‟ ports, the switch must "double tag" any 802.1p and 802.1Q
ingressing frames. This nested-VLAN feature is sometimes known as "QinQ". It
generates 1526 byte frames (which is above the allowed size of some Ethernet
switches). Note that for each additional Q-tag, the frame‟s size increases by 4
bytes.
Refer to Sections 2 and 5 for information on how ETHER-1000 unit supports
VLANs.
Copyright  GE Multilin Inc. 2010-2012
342-86400-498PS
Issue 1.2
April 2012
Page 158