t connections to transform Ethernet in a connection- oriented frame technology. The VLAN was a concept introduced in the Ethernet protocol set to assure security and isolation to sensible data sent via a shared medium LAN. Every VLAN that is created into a switched Ethernet network is identified by a VLAN identifier (VID) that is an integer number from 1 to 4094 (since 0 and 4095 are reserved). Assuming that the network contains more than one switch, in order to use VLAN as vir- tual circuits, it is necessary that each packet traveling through a switch can be assigned to its own VLAN. In order to associate a packet to a VLAN, a two-byte header is added at the beginning of the Ethernet frame by the sender, which is also the VLAN creator. A single sender naturally can transmit packets on different VLAN if it is requested to do so, exactly as it could transmit packets on two different networks if it would be connected to both. This header is called VLAN TAG and contains the VID of the packet. Every traversed switch can recognize that the packet belongs to a certain VLAN and switch it exactly as if it was on a physically separated network. VLAN can be stacked and in the extreme case all the traffic can be ordered in a stacked set of VLANs. This is exactly what carrier Ethernet does: Carrier Class Ethernet is a layer 2 architecture where the traffic is switched using virtual circuits (often called tunnels) each of which is constituted by a different VLAN. In a Carrier Class Ethernet network, a VLAN is created, managed, and tiered down exactly as a circuit in a circuit-oriented switched network. A VLAN creation protocol exists that assures that a VLAN created by a network user is recognized by all the network switches and terminates at the right destination; a set of monitoring procedures exists for the management of a running VLAN; finally, a VLAN tier down procedure exists that eliminates the VLAN when the corresponding connec- tion is ended and informs all the switches of the network that the VLAN has been tiered do