VLAN hopping is an attack technique that allows adversaries to bypass network segmentation by exploiting switch spoofing and double tagging vulnerabilities. This content covers how both attack methods work and the configuration practices used to defend against them.
VLAN Hopping
One of the biggest reasons why we set up VLANs on our network is so that way we can isolate certain VLANs to keep them more protected. Although, an attacker can hop VLANs to jump to another VLAN.
The idea behind VLAN hopping is that an attacker wants to gain access to another VLAN, to communicate onto another VLAN, and they can do that by VLAN hopping. There's a couple of ways they can do that: one is switch spoofing, and another way is double tagging.
One thing that manufacturers will do on your switches is they'll set up the switch to do Dynamic Trunking Protocol. This way, when you connect two switches together, they can communicate all their VLANs from one switch to the other switch, and so this really speeds up the process of configuration. But then Dynamic Trunking Protocol can be leveraged to an attacker's advantage. What they can do is connect into a switch and pretend like they're another switch, to spoof another switch on the network. They can send out Dynamic Trunking Protocol messages to the other switch, thereby communicating and getting access to all the VLANs. There are some tools on Kali Linux that attackers can use to leverage this.
So how do you mitigate against this? Well, first of all, just don't use Dynamic Trunking Protocol. On access ports, we turn trunking on those access ports off completely, and then on our trunk ports we turn off Dynamic Trunking Protocol on those ports.
But an attacker doesn't necessarily need to have a trunk line established with a switch to attack or VLAN hop. The other way the attacker can do this is, if they are on a native VLAN, they can do what's called double tagging to access this other network.
For this to work, an attacker needs to be connected to a port on the switch that is part of the native VLAN. So they're connected to the native VLAN, and they send a frame to this native VLAN with tagging on it. This is 802.1Q tagging that's on there, and it's saying that this is part of whatever the native VLAN is. The default native VLAN is one, so we'll just say that it's part of the native VLAN of one. And then it's got a second tag here that's part of another VLAN, so let's say the second tag is part of VLAN 10.
Now this switch — switch 2 — receives this frame, sees that it's part of VLAN one, the native VLAN, and so then it will remove that part of the tag, since it's the native VLAN, and then it will forward the rest of the frame on to wherever it needs to go. Let's say it's going now to switch one. Switch 1 receives this, but it receives it with the second tag still intact, VLAN 10. So now this attacker has communicated to this switch a frame that is on a different VLAN, and now this attacker has access, to a certain degree — a one-way access — to this VLAN 10.
Now obviously, can the device on that network communicate directly back to this? They're on different VLANs. But perhaps they communicate back to the attacker through a layer three network instead, and so it routes traffic back on a different network. Or maybe this is just a denial of service attack, and so now this attacker is attacking another VLAN that's on your network for a denial of service attack. So there's several ways an attacker can actually leverage this to do harm to your network.
How do you mitigate against VLAN hopping? For one, you just don't have the native VLAN set up on the ports — just don't use the native VLAN in general. I like to use them on some of my trunk lines, but on access ports I don't use a native VLAN. I also change the native VLAN so it's not the default. The native VLAN, if I use it, is set up for a different VLAN that doesn't have any other purpose except for just communicating across trunk lines. So those are two things that I like to do.
Another thing is not to use Dynamic Trunking Protocol, and that mitigates against that first attack that we talked about, where the attacker is using switch spoofing and they try to create a trunk line with the switch. We do that by turning all access ports into access ports, so they can't be trunk ports — they're all just access ports. Then on the trunk lines, just to be extra safe, I like to turn them on so that they are just trunk ports and there's not Dynamic Trunking Protocol going on on those trunk ports. Therefore now you don't have DTP running on any of your ports, and that mitigates against that issue.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →