Explain the two VLAN hopping attacks and how you prevent each one.
Show the answer
Say this first
Switch spoofing: the attacker's device speaks DTP and talks a port left in dynamic auto or desirable
into becoming a trunk, then sends and receives in every VLAN. Prevent it by hard-coding access ports
with switchport mode access and turning off DTP with switchport nonegotiate on trunks. Double
tagging: an attacker in the trunk's native VLAN sends a frame with two 802.1Q tags. The first switch
removes the outer tag because it matches the native VLAN and forwards the frame over the trunk, where
the next switch reads the inner tag and delivers it into the victim VLAN. It only works one way.
Prevent it by keeping users out of the native VLAN and tagging the native VLAN.
Go deeper
Switch spoofing
Many Catalyst models default to dynamic auto, which becomes a trunk if the other side asks. An
attacker sends DTP frames asking for a trunk and gets one.
Double tagging
Only possible when the attacker's access VLAN equals the trunk's native VLAN. The reply from the victim is tagged normally and never comes back to the attacker's VLAN, so it suits one-way attacks such as a flood or a crafted UDP packet.
Hardening template
vlan dot1q tag native
!
interface range GigabitEthernet1/0/1 - 46
switchport mode access
switchport access vlan 10
switchport nonegotiate
spanning-tree portfast
spanning-tree bpduguard enable
!
interface range GigabitEthernet1/0/47 - 48
switchport mode trunk
switchport trunk native vlan 999
switchport trunk allowed vlan 10,20,30
switchport nonegotiateVLAN 999 has no access ports and is not in the allowed list. Unused ports are shut down and parked in an unused VLAN.
They will ask next
Why is double tagging one way?
The victim's reply leaves with one normal tag for its own VLAN. Nothing strips or adds tags to send it back into the attacker's native VLAN.
What does
vlan dot1q tag nativechange?The switch tags native VLAN frames on trunks too, so an outer tag is never stripped on the way out. Both ends of each trunk should agree, because untagged frames arriving on the trunk are then dropped.
Traps
- Thinking VLANs alone are a security boundary. Misconfigured trunks and native VLANs undo them.
- Believing double tagging gives two-way access.