netskillup
← Module 02 · Layer 2: Data Link

Native VLAN & VLAN Hopping

One VLAN on every trunk gets to skip its tag entirely. That convenience is also the exact crack an attacker can wedge a frame into.

The native VLAN

A trunk port tags every frame with its VLAN (Virtual Local Area Network) ID, with one exception: the native VLAN. Frames belonging to it cross the trunk completely untagged, the same way they would on a plain access port. This exists mostly for backward compatibility with older equipment that never understood 802.1Q tags at all.

By default, the native VLAN is VLAN 1 on every port, on every switch, out of the box. That means if nobody changes it, every trunk in a network is quietly agreeing to treat the same VLAN as the "untagged, trust it" one.

Double tagging: How VLAN hopping actually works

An attacker on an access port can't normally reach a different VLAN. Their switch strips any tag they try to add and treats the frame as belonging to their own access VLAN. Double tagging abuses the native VLAN's blind spot instead of fighting that rule directly.

The attacker crafts a frame with two stacked 802.1Q tags: the outer tag set to the native VLAN, the inner tag set to the VLAN they actually want to reach.

ATTACKER'S FRAME MACs Outer tag VLAN 1 Inner tag VLAN 20 Payload Native VLAN tag → stripped by SW1 WHAT SW2 RECEIVES MACs Tag VLAN 20 Payload Looks ordinary → SW2 delivers it One tag was stripped, one was trusted: the frame just hopped from VLAN 1 into VLAN 20. This only works one direction, and only if the attacker's access VLAN happens to match the trunk's native VLAN.
Double tagging: the outer tag gets consumed by the first switch's native-VLAN handling, leaving the inner tag to be trusted by the next one.

The first switch, seeing the outer tag matches its native VLAN, strips it and forwards the frame as if it were a plain untagged native-VLAN frame, carrying the inner tag along for the ride. The next switch down the line unwraps that inner tag and treats it as a completely legitimate frame for the target VLAN. The attacker's traffic just crossed a VLAN boundary it was never granted access to.

HOW THIS IS ACTUALLY PREVENTED

Three habits close this off: set every trunk's native VLAN to something unused (never the default VLAN 1), explicitly tag native VLAN traffic instead of leaving it untagged, and disable auto-trunk negotiation (DTP, Dynamic Trunking Protocol) on ports that shouldn't become trunks in the first place. Any one of these breaks the attack; doing all three is standard hardening.