Another type of Vlan hopping attack is known as double tagging attack.
This type of attack takes advantage of the way that hardware on most switches operates.
Most switches perform only one level of 802 point 1QD encapsulation, which allows an attacker to embed
a hidden 800 and 21Q tag inside the frame.
This tag allows the frame to be forwarded to a Vlan that the original 821 Q tag did not specify.
An important characteristic of the double tagging Vlan hopping attack is that it works even if trunk
ports are disabled because a host typically sends a frame on a segment that is not a trunk link.
So let's see how the double tagging Vlan hopping attack is performed step by step.
The attacker sends a double tagged 802.11 frame to the switch.
The outer header has the Vlan tag of the attacker, which is the same as a native Vlan of the trunk
port.
Normally a switch port configured as a trunk port sends and receives Vlan tagged ethernet frames.
Native Vlan is the only Vlan, which is not tagged in a trunk.
In other words, native Vlan frames are transmitted untagged.
The assumption here is that the switch processes, the frame received from the attacker as if it were
on a trunk board.
In this example, the native Vlan is Vlan one.
The inner tag is the victim.
Vlan.
In this case it's Vlan 20.
The frame arrives on the switch, which looks at the first four byte 802.1 Q tag.
The switch sees that the frame is destined for Vlan one, which is a native Vlan.
The switch forwards the packet out on all Vlan one ports after stripping the Vlan one tag.
On the trunk port.
The Vlan one tag is stripped and the packet is not re tagged because it's part of the native Vlan.
At this point the Vlan 20 tag is still intact and it has not been inspected by the first switch.
The second switch looks only at the inner 802.1 tag that the attacker sent and sees that the frame is
destined for Vlan 20.
The target vlan.
The second switch sends the frame on to the victim port or floods it, depending on whether there is
an existing Mac address table entry for the victim's host.
So the best approach to mitigating double tagging attacks is to ensure that the native Vlan of the trunk
ports is different from the Vlan of any user ports.
Right.
In other words, do not let the users use the native Vlan.
In fact, it's considered a security best practice to use a fixed Vlan that is distinct from all user
VLANs in the switch network as the native Vlan for all 802.1 trunks.