computer science

VLAN hopping

VLAN hopping is a computer science topic covered in the lgStudy science library. This page brings together a partial reference excerpt, illustrations, worked examples, real-world applications and a short study plan, so you can understand VLAN hopping rather than just read about it. In short: VLAN hopping is a computer security exploit, a method of attacking networked resources on a virtual local area network (VLAN). The basic concept behind all VLAN hopping attacks is for an attacking host on a VLAN to gain access to traffic on other VLANs that would normally not be accessible.

Key takeaways

VLAN hopping belongs to computer science; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect VLAN hopping to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of VLAN hopping from memory before moving on to harder problems.

Reference excerpt

VLAN hopping is a computer security exploit, a method of attacking networked resources on a virtual local area network (VLAN). The basic concept behind all VLAN hopping attacks is for an attacking host on a VLAN to gain access to traffic on other VLANs that would normally not be accessible. There are two primary methods of VLAN hopping: switch spoofing and double tagging. Both attack vectors can be mitigated with proper switch port configuration.

Switch spoofing In a switch spoofing attack, an attacking host imitates a trunking switch by speaking the tagging and trunking protocols (e.g. Multiple VLAN Registration Protocol, IEEE 802.1Q, Dynamic Trunking Protocol) used in maintaining a VLAN. Traffic for multiple VLANs is then accessible to the attacking host.

Mitigation Switch spoofing can only be exploited when interfaces are set to negotiate a trunk. To prevent this attack on Cisco IOS, use one of the following methods: 1. Ensure that ports are not set to negotiate trunks automatically by disabling DTP:

Switch (config-if)# switchport nonegotiate 2. Ensure that ports that are not meant to be trunks are explicitly configured as access ports

Switch (config-if)# switchport mode access

Double tagging In a double tagging attack, an attacker connected to an 802.1Q-enabled port prepends two VLAN tags to a frame that it transmits. The frame (externally tagged with VLAN ID that the attacker's port is really a member of) is forwarded without the first tag because it is the native VLAN of a trunk interface. The second tag is then visible to the second switch that the frame encounters. This second VLAN tag indicates that the frame is destined for a target host on a second switch. The frame is then sent to the target host as though it originated on the target VLAN, effectively bypassing the network mechanisms that logically isolate VLANs from one another. However, possible replies are not forwarded to the attacking host (unidirectional flow).

Mitigation Double tagging can only be exploited on switch ports configured to use native VLANs. Trunk ports configured with a native VLAN don't apply a VLAN tag when sending these frames. This allows an attacker's fake VLAN tag to be read by the next switch. Double tagging can be mitigated by any of the following actions (incl. IOS example):

Simply do not put any hosts on VLAN 1 (the default VLAN). i.e., assign an access VLAN other than VLAN 1 to every access port Switch (config-if)# switchport access vlan 2 Change the native VLAN on all trunk ports to an unused VLAN ID. Switch (config-if)# switchport trunk native vlan 999 Explicit tagging of the native VLAN on all trunk ports. Must be configured on all switches in network autonomy. Switch(config)# vlan dot1q tag native

Example As an example of a double tagging attack, consider a secure web server on a VLAN called VLAN2. Hosts on VLAN2 are allowed access to the web server; hosts from outside VLAN2 are blocked by layer 3 filters. An attacking host on a separate VLAN, called VLAN1(Native), creates a specially formed packet to attack the web server. It places a header tagging the packet as belonging to VLAN2 under the header tagging the packet as belonging to VLAN1. When the packet is sent, the switch sees the default VLAN1 header and removes it and forwards the packet. The next switch sees the VLAN2 header and puts the packet in VLAN2. The packet thus arrives at the target server as though it were sent from another host on VLAN2, ignoring any layer 3 filtering that might be in place.

Worked examples

Example 1 — a first encounter with VLAN hopping

Start with the simplest possible case. Write down what VLAN hopping claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In computer science, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to VLAN hopping before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about VLAN hopping ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of VLAN hopping

In research: VLAN hopping appears in computer science research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses VLAN hopping in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: VLAN hopping is common in secondary-school and first-year university syllabi. It links to neighbouring topics Computer network security, Ethernet, so understanding it makes those chapters shorter.
In everyday life: Look for VLAN hopping outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

Ask Teacher Smith questions about this articleOpens your AI tutor with a question about “VLAN hopping” →

Affiliate

Preply — study more efficiently by working with a personal tutor. 50% off.

How to study VLAN hopping in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what VLAN hopping means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain VLAN hopping out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is VLAN hopping in simple terms?

Why does VLAN hopping matter?

Because it connects several computer science ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study VLAN hopping?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on VLAN hopping.