What are the best practices for preventing VLAN hopping?

2 How does VLAN hopping work?

There are two main types of VLAN hopping: switch spoofing and double tagging. Switch spoofing is when an attacker configures their device to act as a switch and sends Dynamic Trunking Protocol (DTP) messages to a switch port, convincing it to become a trunk port. This way, the attacker can access all the VLANs that are allowed on the trunk port. Double tagging is when an attacker inserts two VLAN tags in a packet, one for the attacker's VLAN and one for the target VLAN. The first tag is stripped off by the switch, but the second tag remains and allows the packet to reach the target VLAN.

3 How to prevent switch spoofing?

One of the best practices to prevent switch spoofing is to disable DTP on all switch ports that are not intended to be trunk ports. DTP is a protocol that allows switches to negotiate trunking automatically, but it can also be exploited by attackers. By disabling DTP, you can ensure that only the ports that you configure manually can become trunk ports. You can also limit the VLANs that are allowed on each trunk port, and use strong passwords for the switch management interfaces.

4 How to prevent double tagging?

One of the best practices to prevent double tagging is to use a dedicated VLAN for all the switch ports that connect to untrusted devices, such as end-user computers or access points. This VLAN is called the native VLAN, and it does not have a VLAN tag. By using a separate native VLAN, you can prevent an attacker from sending double-tagged packets that match the native VLAN of the target VLAN. You can also enable IEEE 802.1Q tagging on all trunk ports, which adds a special tag to the native VLAN packets, making them distinguishable from double-tagged packets.

6 How to respond to VLAN hopping?

If you suspect that your network has been compromised by VLAN hopping, you need to act quickly and effectively to contain and mitigate the attack. You can use tools such as network scanners, vulnerability scanners, or antivirus software to identify and remove any malicious devices or software from your network. You can also use features such as VLAN access control lists, private VLANs, or firewall rules to isolate and protect your sensitive VLANs from unauthorized access. You can also review and update your network policies, procedures, and documentation to prevent future attacks.