Skip to content

VLAN hopping

1. Context & stakes

Escape your VLAN via DTP negotiation or 802.1Q double tagging.

VLANs isolate broadcast domains, but that isolation breaks if an access port auto-negotiates a trunk via DTP, or if the attacker double-tags 802.1Q so the outer tag is stripped and the inner tag lands the frame in another VLAN. Either path reaches a VLAN the attacker was segmented out of. Disabling DTP and pruning the native VLAN closes both.

2. Theory

802.1Q tags frames with a VLAN id and trunk ports carry many VLANs. Switch spoofing abuses DTP to negotiate a trunk from an access port, exposing every VLAN. Double tagging stacks two 802.1Q tags: the first switch strips the outer tag and forwards the inner-tagged frame onto the target VLAN (only from the native VLAN).

3. Attack (PoC)

netlab-vlan attack --i-own-this-network --iface veth-host
  1. Switch spoofing via DTP
  2. 802.1Q double tagging into a target VLAN

4. Detection

netlab-vlan detect --iface veth-host

Indicators to watch, and the associated IDS rule (see netlab-ids).

5. Defense

  • Disable DTP (nonegotiate)
  • Dedicated, unused native VLAN

6. Exercise

Reproduce in the isolated lab (netns/veth): see lab setup.

7. Further reading