📖 What is VLAN Hopping?
VLAN Hopping is a network attack that allows an attacker on one VLAN to gain access to traffic on other VLANs that would normally be isolated. This is typically achieved through switch spoofing or double tagging of Ethernet frames.
"Be aware of the difference between switch spoofing (via DTP) and double tagging. Double tagging is specifically used to move traffic from one VLAN to another."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of VLAN Hopping?
- ▸ Switch spoofing exploits Dynamic Trunking Protocol (DTP) to trick a switch into establishing a trunk link, granting access to all permitted VLANs.
- ▸ Double tagging leverages the native VLAN by wrapping frames in two 802.1Q tags, allowing a packet to jump from one VLAN to another.
- ▸ The native VLAN is the untagged VLAN on a trunk; using the default VLAN 1 often makes a network vulnerable to double tagging.
- ▸ Mitigation involves disabling DTP on all user ports, forcing ports into access mode, and changing the native VLAN to an unused ID.
- ▸ Double tagging is typically a unidirectional attack, meaning the attacker can send traffic to a target but cannot receive a direct response.
🎯 How does VLAN Hopping appear on the PT0-002 Exam?
You may be asked to identify the specific attack occurring when an attacker sends a frame with two 802.1Q tags to reach a restricted VLAN.
A scenario might describe a network where DTP is enabled on user ports; you must determine the most likely method for an attacker to gain unauthorized VLAN access.
Expect questions where you must recommend a remediation strategy, such as changing the native VLAN or disabling trunk negotiation, to stop VLAN hopping.
❓ Frequently Asked Questions
Can double tagging be used to establish a full two-way communication session?
No, double tagging is generally unidirectional. While the attacker can successfully send packets to a target on a different VLAN, the return traffic follows standard routing rules and will not be double-tagged back.
Why is it critical to change the default native VLAN from VLAN 1?
Most switches use VLAN 1 as the default for management and native traffic. Attackers target this known default to execute double tagging attacks, as the first switch strips the outer tag of VLAN 1.