VXLAN Explained: An Overlay You Can Read on the Wire

Originally published at https://blog.pathvector.dev/protocol-lab-vxlan-18/ — part of the free Protocol Lab series.

This post is part of Protocol Lab, a free, hands-on series for learning networking protocols by building and breaking them in a container lab. All the lab material — topologies, configs, and scripts — lives in the repo: github.com/pathvector-studio/protocol-lab.

In Lab #16, WireGuard built an encrypted tunnel: the underlay showed only ciphertext. This lab builds a VXLAN overlay, which encapsulates the same way — inner packets inside outer UDP — but does not encrypt. So the underlay reveals both the VXLAN header and the inner frame in the clear.

VXLAN also differs in what it carries: it is a Layer-2 overlay (it tunnels Ethernet frames), the technology data centers use to stretch one virtual L2 network across many physical hosts.

Reading guide: rfc-notes/vxlan-overlay.md