Overview
This lecture covers the purpose of VLANs, how they can be bypassed via VLAN hopping attacks, and methods to prevent such security risks.
VLAN Basics and Usage
- VLANs (Virtual Local Area Networks) separate network traffic for security and organizational purposes.
- Common VLAN uses include separating departments (e.g., Marketing, Accounting) or device types (e.g., IoT, cameras).
- Devices in separate VLANs cannot communicate directly unless routed.
VLAN Hopping Attacks
- VLAN hopping allows an attacker to communicate across VLANs without a router.
- Two main VLAN hopping techniques: switch spoofing and double tagging.
Switch Spoofing
- Switch spoofing exploits dynamic trunk configuration between switches.
- If a switch auto-configures a trunk with a host, the host can access multiple VLANs by impersonating a switch.
- Disabling trunk auto-negotiation removes this vulnerability.
- Administrators should manually define trunk interfaces and allowed VLANs to prevent spoofing.
Double Tagging
- Double tagging involves crafting Ethernet frames with two VLAN tags.
- The first switch removes the outer tag, sending the frame over the native VLAN.
- The second switch removes the inner tag, forwarding the frame to another VLAN.
- This attack is one-way and mainly used for injecting traffic (e.g., denial of service).
Preventing VLAN Hopping
- Do not assign users to the native VLAN.
- Change the default native VLAN ID from 1 to a different value.
- Require tagging on all VLAN traffic, including the native VLAN.
- Manually define which VLANs are allowed on trunk ports.
Key Terms & Definitions
- VLAN (Virtual Local Area Network) — A logical network segment that separates devices for security and performance.
- Switch Spoofing — A VLAN hopping method where a device impersonates a network switch to access multiple VLANs.
- Double Tagging — A VLAN hopping method using Ethernet frames with two VLAN tags to cross VLAN boundaries.
- Native VLAN — The VLAN assigned to untagged traffic on a trunk port.
- Trunk Port — A switch port configured to carry traffic for multiple VLANs.
Action Items / Next Steps
- Review your switch configuration to ensure trunk negotiation and native VLAN settings are secure.
- Read next chapter on network segmentation best practices.