What Is VLAN Hopping?
VLAN hopping lets an attacker reach a network segment they are supposed to be isolated from, defeating the very purpose of VLAN-based segmentation. VLANs create logical separation on shared switches; VLAN hopping exploits switch misconfigurations to cross that boundary — turning a control you rely on into a false sense of security.
How does VLAN hopping work?#
Two classic techniques:
- Switch spoofing — many switch ports will automatically negotiate a trunk (a link carrying all VLANs). An attacker’s device poses as a switch, negotiates a trunk, and gains access to every VLAN.
- Double tagging — the attacker crafts a frame with two VLAN tags. The first switch strips the outer tag and forwards the frame, which then reaches a VLAN determined by the inner tag — one the attacker should not reach.
Both abuse default-permissive switch behavior to slip traffic across boundaries that were assumed to be solid.
How do you prevent it?#
Configuration hardening closes both paths:
| Control | Stops |
|---|---|
| Disable DTP / set ports to access mode | Switch spoofing |
| Change native VLAN off VLAN 1 | Double tagging |
| Prune unused VLANs from trunks | Reduces reachable segments |
| Explicit trunk configuration | Removes auto-negotiation surprises |
VLAN hopping is an attack on network segmentation itself, enabling lateral movement. More at the Network Security hub.
Frequently asked questions#
What is VLAN hopping?
VLAN hopping is an attack that lets a device on one VLAN send traffic to another VLAN it should be isolated from, defeating the segmentation VLANs are meant to provide. The two classic techniques are switch spoofing (posing as a switch to negotiate a trunk) and double tagging (nesting VLAN tags to slip past the first switch).
How do you prevent VLAN hopping?
Disable automatic trunk negotiation (DTP) on access ports, explicitly set ports to access mode, avoid using the default VLAN 1 and change the native VLAN to an unused one, and prune unnecessary VLANs from trunks. These configuration steps close both switch-spoofing and double-tagging avenues.