Why VLAN 1 deserves a second look

VLAN 1 is the factory-default native/management VLAN on the overwhelming majority of switch platforms, which is exactly why network hardening guidance generally recommends moving user and management traffic off it: because it's the default, it's also the VLAN that untagged traffic ends up on if a port's configuration is ever wrong or incomplete, and it's the VLAN attackers assume exists during VLAN-hopping attempts (double-tagging attacks specifically target the native VLAN). None of that makes VLAN 1 unusable — it makes it worth a deliberate decision rather than a default left in place, which is why this tool flags it rather than treating it as just another number in range.

What "valid" means here, and what it doesn't

The 1-4094 range comes directly from the IEEE 802.1Q standard's 12-bit VLAN ID field — 0 and 4095 are reserved by the standard itself and can't be configured on compliant hardware, which is a hard rule true everywhere. Beyond that hard boundary, individual switch vendors and platforms often carve out their own additional reserved ranges internally (for internal VLANs, private VLANs, or platform-specific features) that this tool has no way of knowing about, since they aren't part of the 802.1Q spec — checking a vendor's actual VLAN database and reserved-range documentation is still necessary before assuming an ID in the valid range is actually free to use on a specific switch.