ProCurve 1800 - what does "Ingress filtering" option do?

[Paul.Kraus]

Could you please explain the functionality of the "Ingress filtering" option on the ProCurve 1800 switch.

According to the Management and Configuration Guide(p.38):

'Ingress Filtering Enabled – If enabled, incoming frames for VLANs
which do not include this ingress port in their member set will be
discarded. (Default: Disabled)'

This would imply that when "Disabled", which is the default setting, tagged frames received on the port would be accepted no matter what VLAN id they contained, even if the port were not a member of that VLAN.

However, the next paragraphs in the same Management and Configuration Guide describing the "Packet Type" option clearly state that in the case of Packet Type "All":

'Tagged packets will be dropped unless the port is a member of the VLAN identified by the VLAN tag in the packet.'

and in the case of Packet Type "Tagged Only":

'Tagged packets will be dropped unless the port is a member of the VLAN identified by the VLAN tag in the packet.'

[Marco Wessel]

I've been wondering this myself. I even looked into it a bit, and when I tested it the switch correctly dropped frames tagged with the wrong vlan in most cases with the setting not making much of a difference.

I say most cases, because the switch did forward broadcast frames (dst ff:ff:ff:ff:ff:ff) with the wrong vlan tag to other vlans (which it should not, of course). I tested this a long time ago though, things may have changed in the mean time.