VLAN hopping: jumping the segmentation

July 1, 2025 · 1 min read · #network #vlan #switching

VLANs separate broadcast domains on a switch. Hopping reaches a VLAN your port should not access.

Two techniques

Switch spoofing: if the port has DTP enabled, the attacker pretends to be a switch and negotiates a trunk, receiving all VLANs.

Double tagging: two 802.1Q tags are stacked. The first switch strips the outer tag (its native VLAN) and forwards; the second reads the inner tag and delivers to the target VLAN. Egress-only, but effective for one-way attacks.

[ Eth ][ 802.1Q vlan1 ][ 802.1Q vlan20 ][ payload ]

Defence

Disable DTP (switchport mode access + nonegotiate). Change trunks' native VLAN to an unused one and do not use it for access. Do not assign the native VLAN to user ports. Explicit tagging on all trunk VLANs.

« back to home