VLAN Hopping: Switch Spoofing & Double Tagging

VLANs let one physical switch pretend to be many. The finance department, the guest wifi, and the server management network can all share the same hardware while behaving as separate, isolated networks. That isolation is a load-bearing part of most segmentation designs. A guest on the visitor VLAN should have no path to the machines on the server VLAN.

VLAN hopping is the family of techniques that breaks that promise. It lets a device sitting on one VLAN send frames into another VLAN it was never meant to reach. The segmentation looks intact in the configuration, but at the frame level the wall has a gap. Because so many networks lean on VLANs as a primary control, a working hop can drop an attacker straight into a segment full of sensitive systems.

How VLAN tagging works

To carry many VLANs over one link, switches label frames. The 802.1Q standard inserts a small tag into the Ethernet frame that records which VLAN the frame belongs to. Two port roles matter here:

Access ports connect to end devices like a laptop or a printer. They carry a single VLAN and the device never sees the tag. The switch adds the tag on the way in and removes it on the way out.
Trunk ports connect switches to each other, or a switch to a router. They carry many VLANs at once, and frames travel tagged so the far end knows which VLAN each frame belongs to.

There is one special case: the native VLAN on a trunk. Frames on the native VLAN traditionally cross the trunk untagged. That exception, a leftover from older gear, is exactly what the double tagging attack abuses.

Switch spoofing

The first hopping technique attacks how trunks get created. On many switches, ports can negotiate their own role automatically using Dynamic Trunking Protocol, DTP. Leave a port in its default dynamic mode and it will happily form a trunk with any neighbor that asks for one.

An attacker exploits this by pretending to be a switch. The attacker's machine sends DTP messages requesting a trunk. The port, set to negotiate, agrees and becomes a trunk. The moment it does, the attacker's port stops being limited to a single access VLAN and starts carrying every VLAN the switch trunks. The attacker can now send and receive frames on any of them, walking straight past the segmentation.

Switch spoofing is the more powerful of the two techniques because it gives two-way access to all VLANs at once. It also depends entirely on a default that should be turned off.

Auto-negotiation is the whole vulnerability

Switch spoofing only works because the access port was willing to become a trunk on request. A port that is hardcoded as an access port, with trunk negotiation disabled, simply ignores the attacker's DTP messages. This is a configuration problem with a configuration fix, and the fix costs nothing but the discipline to set every access port explicitly.

Double tagging

The second technique is narrower and sneakier. It targets the native VLAN and the fact that a switch strips only one VLAN tag as a frame enters a trunk.

The attacker crafts a frame with two stacked 802.1Q tags. The outer tag is set to the native VLAN of the trunk. The inner tag is set to the target VLAN the attacker wants to reach. The path plays out like this:

The frame arrives at the first switch on an access port in the native VLAN.
The first switch removes the outer tag, the native VLAN tag, and forwards the frame across the trunk.
The frame still carries the inner tag. The second switch reads that inner tag and delivers the frame into the target VLAN.

The frame has hopped. Two important limits define this attack. It only works if the attacker's access VLAN matches the trunk's native VLAN, which is why moving the native VLAN off any used VLAN defeats it. And it is one-way: the attacker can push frames into the target VLAN but receives no replies, because the return path has no matching double-tag trick. One-way is still useful for blind attacks, spoofed commands, or triggering actions on a target host.

The narrowness of double tagging is exactly why it is easy to overlook. It leaves no obvious two-way session, it fails silently when the native VLAN does not line up, and it can look like ordinary malformed traffic to anyone not watching for stacked tags. That combination makes it a quiet probe an attacker can try against a trunk without much risk of standing out, which is one more reason to remove its precondition rather than hope to catch it in the act.

The two techniques compared

Property	Switch spoofing	Double tagging
What it abuses	Dynamic trunk negotiation (DTP)	Single-tag stripping and the native VLAN
Access gained	Two-way, all trunked VLANs	One-way, into a single target VLAN
Key precondition	Port left in dynamic/negotiating mode	Attacker VLAN equals the trunk native VLAN
Primary fix	Hardcode access ports, disable DTP	Move native VLAN to an unused ID, tag it
Relative power	High, full trunk access	Lower, blind and directional

Why VLAN hopping matters beyond the hop

Reaching another VLAN is rarely the end goal. The value is in what lives on the far side. Segmentation usually isolates the segments worth protecting: server VLANs, out-of-band management networks, storage, and administrative interfaces. A successful hop turns a foothold on a low-value segment, a compromised guest device or a lobby network port, into a launch point against those protected systems. From there the attacker can pivot with the same Layer 2 tricks that work on any shared segment, like ARP spoofing or a rogue DHCP server.

For the actors who chain internal network manipulation into full intrusions, our Threat Groups directory maps who relies on lateral movement through segmentation gaps and how those campaigns unfold.

Segmentation within a segment

VLANs are one layer of separation, and there are finer-grained controls for cases where even hosts on the same VLAN should not talk to each other freely. Private VLANs, described in RFC 5517, subdivide a single VLAN into isolated and community port groups so that devices sharing a subnet can be prevented from reaching one another while still using the same gateway. Service providers use this to keep customers on a shared segment apart, and enterprises use it on hostile segments like a guest network. Private VLANs do not stop the hopping techniques above on their own, but they reduce what an attacker can reach after landing on a segment, which is the same defense-in-depth logic that says a VLAN should never be your only wall.

How to defend against VLAN hopping

Every one of these is a configuration setting, and together they close both techniques completely.

Disable dynamic trunking on all access ports. Set access ports explicitly to access mode and turn off DTP negotiation. A port that will not negotiate a trunk cannot be spoofed into one.
Hardcode trunk ports too. Configure real trunks statically rather than by negotiation, and prune each trunk to carry only the VLANs it actually needs.
Move the native VLAN to an unused ID. Never leave the native VLAN as the default and never assign user devices to it. Better still, force tagging on the native VLAN so no frame crosses the trunk untagged, which removes the double tagging path.
Shut down unused ports and assign them to a dead VLAN. An unused port left in the default VLAN and negotiating is an open invitation.
Apply port security and 802.1X. Limit which devices can appear on a port and require authentication before the port carries user traffic, so an attacker cannot freely plug in and start negotiating.
Do not treat VLANs as a security boundary on their own. For traffic that genuinely must not mix, back the VLAN separation with routed firewall controls or physical separation, so a Layer 2 slip does not hand over the whole segment.

Defaults are the enemy here

Both VLAN hopping techniques rely on switch defaults that favour convenience: ports that auto-negotiate trunks and a native VLAN left on a used ID. There is no exploit code to fear and no patch to wait for. Walk every switch, pin every access port, prune every trunk, and relocate the native VLAN. The attack surface is the configuration you never changed.

A worked example: a double-tagged frame's journey

Trace one crafted frame from the attacker's port to the target VLAN to see why double tagging works and why its one-way limit is baked into the mechanism.

Assume the attacker is plugged into an access port assigned to VLAN 1, and VLAN 1 is also the native VLAN of the trunk between the two switches. The target is a host on VLAN 20 that the attacker cannot normally reach. The attacker builds an Ethernet frame with two 802.1Q tags stacked in front of the payload. The outer tag reads VLAN 1. The inner tag reads VLAN 20. The destination in the payload is the target host on VLAN 20.

Step one: the frame enters the first switch on the VLAN 1 access port. The switch sees an incoming frame and needs to decide how to forward it. Because the port belongs to the native VLAN and the outer tag matches that native VLAN, the switch treats the frame as native traffic and, following the native-VLAN convention, forwards it across the trunk with the native tag removed. It strips exactly one tag, the outer one.

Step two: the frame is now on the trunk, still carrying its inner VLAN 20 tag, and it looks like an ordinary tagged frame for VLAN 20. The second switch receives it, reads the VLAN 20 tag, and delivers the frame into VLAN 20 where the target lives. The frame has crossed a boundary it should never have crossed, using nothing but the switches' own tag-handling rules.

Now ask about the reply. The target sends its response back as a normal single-tagged VLAN 20 frame. There is no second switch downstream that will strip a native tag and expose a hidden inner tag pointing back at the attacker's VLAN. The return path has no equivalent trick, so the response never finds its way back through the double-tag mechanism. That is the structural reason double tagging is one-way: the tag-stripping asymmetry only exists in the forward direction. The attacker can push a frame in but cannot receive a session back, which is why the technique suits blind, fire-and-forget actions.

Notice the two preconditions the walkthrough exposes. The outer tag had to equal the trunk's native VLAN, and the native VLAN had to carry the attacker's access traffic. Break either one, by moving the native VLAN to an unused ID or by forcing all native traffic to be tagged, and step one never strips the tag the way the attacker needs.

Detection signals

VLAN hopping leaves traces if you know where to look. These signals help catch an attempt or the misconfiguration that enables one.

DTP frames on access ports. Dynamic Trunking Protocol negotiation messages arriving on a port that connects to an end-user device are abnormal. A host has no reason to negotiate a trunk, so DTP from an access port suggests a switch-spoofing attempt.
Unexpected trunk formation. A port that transitions to trunk mode when it should stay an access port is a direct alarm. Switch logs and interface-state monitoring surface this.
Double-tagged frames. Frames carrying two stacked 802.1Q tags are not normal end-user traffic. A packet capture on the trunk, or an intrusion sensor watching for nested tags, flags them.
MAC address appearing on unexpected VLANs. A single host MAC that shows up associated with a VLAN it was never provisioned for can indicate a successful hop.
Native VLAN mismatch logs. Switches often log when the native VLAN configured on two ends of a trunk disagrees. That noise can accompany tampering and also flags the risky configuration that double tagging needs.
Traffic on a VLAN with no legitimate source. Frames arriving in a protected segment that no provisioned device on that segment sent are worth investigating as a possible hop.

The configuration is the audit

Most VLAN hopping is caught before any packet flies, by auditing the switch configuration. Every access port explicitly set to access mode with negotiation off, every trunk pruned and statically defined, and a native VLAN parked on an unused, tagged ID together mean there is no default left for either technique to abuse. Reviewing the running configuration is a more reliable detection method than watching for the attack live.

Where VLAN hopping sits among Layer 2 attacks

Hopping is one of several attacks that abuse trust at the switching layer. Placing it among its neighbours clarifies what each defense covers.

Attack	What it targets	Effect	Primary defense
Switch spoofing	Dynamic trunk negotiation	Two-way access to all trunked VLANs	Disable DTP, hardcode access ports
Double tagging	Native-VLAN tag stripping	One-way frame injection into a target VLAN	Tagged, unused native VLAN
ARP spoofing	ARP cache trust	On-path interception within a segment	Dynamic ARP Inspection
DHCP spoofing	Rogue DHCP replies	Malicious gateway or DNS assignment	DHCP snooping
MAC flooding	CAM table capacity	Switch fails open, floods frames	Port security, MAC limits

The shared theme is that Layer 2 was designed for a cooperative environment and trusts what it is told. VLAN hopping abuses trust in trunk negotiation and tagging; the neighbours abuse trust in address resolution, address assignment, and forwarding tables. This is why a hardened switch configuration, port security, and 802.1X show up as defenses across the whole family rather than against hopping alone.

How the risk evolved

The features VLAN hopping abuses were conveniences, added when networks were smaller and more trusted. Dynamic Trunking Protocol let an administrator plug a new switch into any port and have the trunk form itself, saving manual configuration in an era when the person plugging in the cable was assumed to be staff. The untagged native VLAN was a compatibility bridge to older equipment that did not understand tagging, so at least one VLAN could cross a trunk in the format that legacy gear expected. Both made sense for their time.

Segmentation then grew into a security control. Networks began leaning on VLANs to separate guests from staff, users from servers, and production from management, which turned those old conveniences into liabilities. A default that auto-negotiates a trunk is harmless when every port faces a trusted switch and dangerous the moment a port faces a lobby or a guest. The response has been a steady shift in guidance toward explicit configuration: pin every port, negotiate nothing, tag the native VLAN, and treat the switch config as a security surface to audit. The techniques themselves did not change much; what changed is that the same defaults now sit in far more hostile places, so the discipline of turning them off has moved from optional tidiness to a baseline control.

Common misconceptions

"VLANs are a security boundary." VLANs are a segmentation tool whose isolation depends entirely on switch configuration. For traffic that genuinely must not mix, back the VLAN with routed firewall controls or physical separation. A VLAN alone is a convenience boundary that a configuration slip can erase.

"Double tagging lets an attacker take over a host on another VLAN." It is one-way. The attacker can inject frames into the target VLAN but receives no replies through the mechanism, so it supports blind actions rather than interactive sessions. Useful, but far more limited than switch spoofing.

"Modern switches are not vulnerable." The techniques rely on defaults, not bugs. A modern switch left with ports in dynamic negotiation mode and the native VLAN on a used ID is exactly as exposed as an old one. The fix is configuration, and it applies regardless of hardware age.

"Turning off DTP fixes everything." Disabling dynamic trunking closes switch spoofing, but double tagging targets the native VLAN and tag stripping instead. You also need to move and tag the native VLAN. Both fixes are required to close both techniques.

"An attacker needs special hardware." Crafting DTP messages or stacked-tag frames is done with ordinary software on an ordinary network interface. The barrier is the switch configuration, not the attacker's equipment.

Frequently asked questions

What is VLAN hopping in one sentence? It is any technique that lets a device on one VLAN send frames into another VLAN it should be isolated from, defeating the segmentation the network relies on.

What is the difference between switch spoofing and double tagging? Switch spoofing tricks a port into becoming a trunk by abusing automatic trunk negotiation, giving two-way access to every trunked VLAN. Double tagging smuggles a frame into one target VLAN by stacking two tags and exploiting native-VLAN tag stripping, and it works in only one direction.

Why does moving the native VLAN stop double tagging? Double tagging requires the attacker's access VLAN to match the trunk's native VLAN so the first switch strips the outer tag as native traffic. If the native VLAN is an unused ID that carries no user ports, the precondition never holds, and forcing all native traffic to be tagged removes the untagged-forwarding step entirely.

Is VLAN hopping still relevant on current networks? Yes, because the techniques exploit configuration defaults that remain common. Any switch where access ports still negotiate trunks, or where the native VLAN sits on a populated ID, is exposed regardless of how new the equipment is.

What is the attacker usually after? The hop itself is a stepping stone. The value is reaching a protected segment, such as a server VLAN, a management network, or storage. Once there, the attacker pivots with the same Layer 2 tricks that work on any shared segment.

Do private VLANs prevent VLAN hopping? No. Private VLANs limit communication between hosts within a single VLAN, which reduces what an attacker can reach after landing on a segment. They do not stop switch spoofing or double tagging, which are about crossing between VLANs. They are a complementary defense-in-depth control.

How do I know if my switches are configured safely? Audit each switch: access ports set explicitly to access mode with trunk negotiation disabled, trunks defined statically and pruned to only needed VLANs, the native VLAN moved to an unused ID and tagged, unused ports shut and parked in a dead VLAN, and port security or 802.1X enforced. If all of those hold, both hopping techniques run out of room.

VLAN hopping is a reminder that segmentation lives in the switch configuration. The VLANs are real, but the walls between them hold only as long as the switch is set up to enforce them. Turn off trunk auto-negotiation, hardcode your access ports, move the native VLAN out of the way, and layer authentication on top. Do that and both switch spoofing and double tagging run out of room before they start.