About this interactive
From the lesson:
- **Switch spoofing:** the attacker's machine sends Dynamic Trunking Protocol messages and negotiates a trunk with a port left in a dynamic mode, then reaches every VLAN on it. **Stop it:** make every user port an access port and turn DTP off on trunks.
- **Double tagging:** an attacker in the trunk's native VLAN sends a frame with two 802.1Q tags. The first switch strips the outer, native-VLAN tag and sends the frame across the trunk untagged; the next switch reads the inner tag and delivers it into the target VLAN. It works one way only. **Stop it:** move the native VLAN to an unused VLAN that no host uses.
What you'll learn
- Tell switch spoofing, where an attacker negotiates a trunk with DTP, from double tagging, where a frame with two 802.1Q tags hops out of the native VLAN
- Match each mitigation to the attack it stops: access mode and no DTP for switch spoofing, an unused native VLAN for double tagging
Aligned to
Cisco CCNA
5.7
Configure and verify Layer 2 security features
2.2
Configure and verify interswitch connectivity
Key terms
- VLAN Hopping
- An attack in which traffic reaches a VLAN it should not, either by negotiating a trunk on a port left in dynamic mode or by double-tagging a frame so the outer tag is stripped as the native VLAN and the inner tag carries it into another VLAN.
- Switch Spoofing
- A VLAN hopping attack where an attacker mimics a switch by sending Dynamic Trunking Protocol messages to establish a trunk link and gain access to all VLANs.
- Double Tagging
- A VLAN hopping attack where an attacker on the native VLAN embeds two 802.1Q tags in a frame so that the second tag delivers the frame to a target VLAN after the first tag is stripped by an upstream switch.
- Dynamic Trunking Protocol
DTP
- A Cisco proprietary protocol that automatically negotiates whether to establish a VLAN trunk link between two switches. DTP allows switches to dynamically determine trunking mode, though it is often disabled in production environments for security reasons.
- Native VLAN
- The one VLAN on an 802.1Q trunk whose frames are sent untagged. Any untagged frame received on the trunk is assigned to it. Both ends of a trunk must be configured with the same native VLAN.
- 802.1Q Tag
- An optional four-octet field inserted into an Ethernet frame header to identify which VLAN the frame belongs to.
Topics
Vlan Hopping
Switch Spoofing
Double Tagging
Dtp
Native Vlan
Layer 2 Security
Interactive
Streak Sort
About TechKnowSurge
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →