VLAN Hopping Attack Explained (and How to Prevent It)

Why VLANs can be hopped at all

A VLAN is a logical broadcast domain. Isolation between VLANs is enforced by the switch, based on the 802.1Q tag carried in the frame header. If an attacker can influence how that tag is applied or interpreted, the isolation breaks.

Both attacks exploit switch defaults, not switch bugs. That is the important lesson: a switch straight out of the box, with ports left at their default settings, is vulnerable. Security here is something you configure, not something you get for free.

Method 1: Switch spoofing

By default, many Cisco access ports run DTP (Dynamic Trunking Protocol) in dynamic auto or dynamic desirable mode. DTP lets two switches negotiate a trunk automatically.

The attack: the attacker's machine sends DTP frames pretending to be a switch that wants to form a trunk. The port obligingly negotiates a trunk link. Now the attacker's port is a trunk — and a trunk carries all VLANs. The attacker can tag frames for any VLAN and receive traffic from any VLAN.

• Requires: the port is in a DTP-negotiating mode (the default on many platforms).
• Gives the attacker: full bidirectional access to every VLAN on the trunk.
• Severity: high — this is complete VLAN isolation bypass.

The fix is to make sure access ports can never become trunks:

Switch(config)# interface range GigabitEthernet0/1 - 24
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 10
Switch(config-if-range)# switchport nonegotiate
Switch(config-if-range)# shutdown

switchport mode access hardcodes the port as an access port. switchport nonegotiate disables DTP entirely so the port will not even respond to negotiation attempts. And genuinely unused ports should be shutdown — an unused port that is administratively down cannot be attacked at all.

Method 2: Double tagging

This one is more subtle, and it is the one people get wrong on the exam. It exploits how a switch handles the native VLAN.

Recall the rule: frames on the native VLAN traverse a trunk untagged. The sending switch strips the native VLAN tag; the receiving switch adds it back.

The attack, step by step:

• The attacker sits on an access port in VLAN 1 (which is also the trunk's native VLAN — the default).
• The attacker crafts a frame with two 802.1Q tags: an outer tag for VLAN 1, an inner tag for the target VLAN 20.
• The first switch receives it, sees the outer tag matches the native VLAN, and strips the outer tag — as it is supposed to.
• The frame goes out the trunk still carrying the inner VLAN 20 tag.
• The second switch reads that inner tag and forwards the frame into VLAN 20. The attacker has hopped.

Two critical properties of this attack:

• It is one-way only. The attacker can send frames into VLAN 20 but receives nothing back, because the return traffic has no way to get to them. That makes it useful for DoS or for a blind injection attack, not for interactive access.
• It requires the attacker's access VLAN to match the trunk's native VLAN. This is the entire basis of the fix.

The complete prevention config

Four changes, and both attacks are dead:

! 1. Hardcode access ports and kill DTP
Switch(config)# interface range Gi0/1 - 24
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport nonegotiate

! 2. Hardcode trunks and kill DTP there too
Switch(config)# interface GigabitEthernet0/48
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport nonegotiate

! 3. Change the native VLAN away from VLAN 1 to an unused VLAN
Switch(config-if)# switchport trunk native vlan 999

! 4. Restrict the trunk to only the VLANs it actually needs
Switch(config-if)# switchport trunk allowed vlan 10,20,30

Why each one matters:

You can also tag the native VLAN globally, which forces even native-VLAN frames to carry a tag and removes the double-tagging primitive completely:

Switch(config)# vlan dot1q tag native

Putting it in context

VLAN hopping is a good illustration of a broader security principle: defaults are chosen for convenience, not safety. DTP exists so that plugging two switches together "just works". VLAN 1 as the default native VLAN exists so that a switch works out of the box. Both are reasonable engineering choices — and both are exactly what the attacker exploits.

The habit worth building is to explicitly configure the thing you want, rather than accepting whatever the device does by default. That same instinct applies to MAC flooding, rogue DHCP servers and ARP spoofing — the other classic Layer 2 attacks you will meet in CCNA and in the field. See our CyberOps guide for how these fit into a defensive security programme.

Frequently asked questions

Related articles