VLANHopping

VLAN hopping is a network attack in which an attacker gains access to VLANs other than the one assigned to a device, by exploiting VLAN tagging or switch configuration. The goal is to move from a compromised or legitimately connected VLAN into other VLANs, potentially reaching sensitive resources or networks that should be isolated.

There are two common techniques. Switch spoofing, sometimes called trunking or DTP-based hopping, involves connecting a rogue device or switch to an access port. The attacker’s equipment negotiates a trunk link with the legitimate switch (often via the Dynamic Trunking Protocol), causing the port to operate as a trunk and carry traffic for multiple VLANs. The rogue device then gains access to VLANs beyond the original one.

Double tagging is a frame-based method. The attacker sends frames that carry two 802.1Q tags: an outer tag for a VLAN that is allowed on the trunk, and an inner tag for the target VLAN. When the inner tag is preserved by intermediate switches, the traffic is delivered into the target VLAN, potentially bypassing access controls.

Mitigation measures include disabling dynamic trunking protocol on access ports and configuring ports statically as access or trunk with a defined set of allowed VLANs. Disable DTP or set switchport nonegotiate where feasible, and restrict trunk ports to only necessary VLANs. Enforce port security and consider 802.1X authentication, as well as network segmentation and monitoring to detect unauthorized devices or unusual trunking activity. Implementing private or restricted VLANs and VLAN ACLs can further limit inter-VLAN traffic that an attacker could access.