VLAN Hopping.

A switch attack that lets a host send or receive frames in a VLAN it should not belong to by abusing trunking negotiation or 802.1Q double tagging. It belongs to the Attacks & Threats category of cybersecurity.

A switch attack that lets a host send or receive frames in a VLAN it should not belong to by abusing trunking negotiation or 802.1Q double tagging.

VLAN hopping abuses Layer-2 segmentation provided by 802.1Q tags. Two main variants exist: switch spoofing, where the attacker negotiates a DTP trunk with the switch and then has access to every allowed VLAN; and double tagging, where the attacker sends a frame with two 802.1Q headers - the outer matching the native VLAN of the trunk, the inner identifying the victim VLAN - so the first switch strips the outer tag and forwards the frame across the trunk into the inner VLAN. The attack typically yields one-way traffic but enables reconnaissance or DoS. Defenses: disable DTP (switchport mode access, switchport nonegotiate), use a dedicated unused native VLAN, tag the native VLAN explicitly, and avoid placing user ports in trunk mode.

Defences for VLAN Hopping typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Switch spoofing, 802.1Q double tagging, Q-in-Q hopping.