How VXLAN Encapsulates Ethernet Frames in UDP

Virtual Extensible LAN (VXLAN) is an overlay network technology designed to extend Layer 2 network domains over an underlying Layer 3 IP network. This article explains how VXLAN performs encapsulation by packaging original Ethernet frames inside standard User Datagram Protocol (UDP) packets, detailing the role of Virtual Tunnel Endpoints (VTEPs), the step-by-step encapsulation workflow, and the structure of the resulting network packet.

The Role of Virtual Tunnel Endpoints (VTEPs)

The encapsulation and decapsulation processes are handled by Virtual Tunnel Endpoints (VTEPs). A VTEP is a network entity—implemented in software on a hypervisor or in hardware on a switch/router—that connects the virtualized Layer 2 overlay to the physical Layer 3 underlay network.

Each VTEP has an IP address on the underlay network. When a device (such as a virtual machine or container) transmits a frame intended for another device in the same broadcast domain across the network, the local VTEP intercepts the frame and encapsulates it for transport.

Step-by-Step Encapsulation Process

1. Frame Capture: The source host generates a standard Ethernet frame containing its source MAC address, the destination MAC address, and the payload (such as an IP packet). The local VTEP captures this frame.
2. Lookup and Mapping: The VTEP inspects the destination MAC address and the local VLAN/port configuration. It maps the local network to a 24-bit VXLAN Network Identifier (VNI) and queries its forwarding table to identify the IP address of the destination VTEP hosting the target MAC address.
3. Adding the VXLAN Header: The VTEP prepends an 8-byte VXLAN header to the original Ethernet frame. This header includes dynamic control flags and the 24-bit VNI, which allows for up to 16 million distinct Layer 2 segments.
4. Adding the UDP Header: An 8-byte UDP header is placed around the VXLAN payload.
   • Destination Port: Standardized to UDP port 4789 (assigned by IANA).
   • Source Port: Calculated dynamically using a hash of the inner frame’s headers (such as source and destination IP and MAC addresses). This enables equal-cost multi-path (ECMP) routing and load balancing across the physical underlay without inspecting the inner frame.
5. Adding Outer IP and Ethernet Headers:
   • An Outer IP Header (20 bytes for IPv4) is added, where the source IP is the local VTEP and the destination IP is the remote VTEP.
   • An Outer Ethernet Header (14 bytes) is added with the MAC addresses corresponding to the local physical next-hop gateway in the underlay network.

The Encapsulated Packet Structure

From outermost layer to innermost layer, a fully encapsulated VXLAN packet contains:

• Outer Ethernet Header: Contains source and destination MAC addresses for underlay routing.
• Outer IP Header: Contains source and destination VTEP IP addresses.
• Outer UDP Header: Destination port set to 4789; source port hashed for load balancing.
• VXLAN Header: 8 bytes containing the 24-bit VNI.
• Inner Ethernet Frame: The complete, unmodified original Layer 2 frame (Original MAC header, Original IP header, Payload, and CRC).

Because the entire original frame is wrapped inside this structure, VXLAN adds 50 bytes of overhead (or 54 bytes if an outer 802.1Q VLAN tag is used). Consequently, underlay physical networks typically require a Maximum Transmission Unit (MTU) of at least 1550 or 1600 bytes (Jumbo Frames) to avoid packet fragmentation.

The Decapsulation Process

Once the packet traverses the Layer 3 underlay and reaches the destination VTEP:

1. The destination VTEP inspects the outer IP header and the UDP destination port (4789).
2. Recognizing it as VXLAN traffic, the VTEP strips off the outer Ethernet, IP, UDP, and VXLAN headers.
3. The VTEP validates the VNI to ensure the frame belongs to an authorized local segment.
4. The inner, original Layer 2 Ethernet frame is forwarded directly to the destination virtual machine or port without any modification.