802.1Q VLAN Tagging: Trunks, Native VLANs and VLAN Hopping

A VLAN divides one physical switch into several logical broadcast domains. 802.1Q is the standard that lets those domains span multiple switches, by inserting a four-byte tag into the Ethernet frame that says which VLAN it belongs to. Almost everything interesting about VLAN security comes from the details of that tag and from one unfortunate exception to it.

The tag

The 802.1Q tag sits between the source MAC address and the EtherType field. Four bytes: a two-byte tag protocol identifier marking the frame as tagged, then three bits of priority for quality of service, one drop-eligible bit, and twelve bits of VLAN identifier.

Twelve bits gives 4096 values, with 0 and 4095 reserved, so 4094 usable VLANs. That ceiling is the reason large multi-tenant data centers moved to overlays — the 24-bit identifier in VXLAN exists precisely because 4094 segments is not enough for a cloud provider.

Because four bytes are added, the maximum frame grows to 1522 bytes. Switches handle this transparently; equipment that does not expect it produces "giant" frame errors, which is a recognizable symptom of a device that has not been configured for tagging.

Access ports and trunk ports

An access port belongs to one VLAN and carries untagged frames. The connected device knows nothing about VLANs; the switch adds the tag on ingress and removes it on egress. End hosts connect here.

A trunk port carries traffic for multiple VLANs between switches, or to a router or hypervisor, and frames are tagged so the far end knows which VLAN each belongs to.

The exception is the native VLAN. Traffic in the native VLAN crosses a trunk untagged, a compatibility feature for devices that predate tagging. It defaults to VLAN 1, and it is the root of most VLAN security problems.

VLAN hopping

Two attacks, both well understood and both entirely preventable.

Switch spoofing exploits dynamic trunking. Many switches negotiate trunk formation automatically, so an attacker's device that speaks the negotiation protocol can persuade the switch to form a trunk with it — at which point it receives traffic for every VLAN allowed on that trunk. The fix is to disable dynamic negotiation and configure every port explicitly as access or trunk.

Double tagging exploits the native VLAN. The attacker sends a frame with two tags: an outer tag matching the trunk's native VLAN and an inner tag for the target VLAN. The first switch strips the outer tag — because native VLAN traffic goes untagged — and forwards the frame, which now carries only the inner tag, on to the next switch. That switch reads the remaining tag and delivers it into the target VLAN.

The attack is one-way: replies do not come back. That is enough for a denial of service or for injecting traffic, and it requires the attacker's access port to be in the native VLAN.

Hardening the configuration

Change the native VLAN on every trunk to an unused VLAN that carries no user traffic, and do not use VLAN 1 for anything. Better still, tag the native VLAN so nothing crosses a trunk untagged at all.

Disable dynamic trunking on every access port and set the mode explicitly. Prune each trunk to the VLANs it actually needs rather than allowing all — a trunk carrying every VLAN turns any trunk compromise into a full compromise.

Shut down unused ports and assign them to an unused VLAN, so a cable plugged into an empty jack reaches nothing. Combine this with the access port protections — BPDU Guard and PortFast — and with 802.1X, which authenticates the device before the port is opened at all and can assign the VLAN dynamically based on who connected.

What VLANs are and are not

A VLAN is a broadcast domain boundary. It is not a security boundary on its own, because traffic between VLANs passes through a router or layer 3 switch, and if that device permits everything then the VLANs are separated logically and not at all in terms of access.

Segmentation only becomes a control when access lists or a firewall enforce policy between the segments. A flat network with twelve VLANs and permit-any routing between them has twelve broadcast domains and one security zone — which is the distinction behind threat scope reduction, and the reason segmentation projects fail when nobody writes the inter-VLAN policy.

Exam angles

Know the 802.1Q tag as four bytes containing a 12-bit VLAN ID, giving 4094 usable VLANs, and that it increases maximum frame size to 1522 bytes. Distinguish access ports (one VLAN, untagged) from trunk ports (multiple VLANs, tagged) and know that the native VLAN crosses trunks untagged. Explain switch spoofing and double tagging, and name disabling dynamic trunking, changing the native VLAN, and pruning allowed VLANs as the mitigations.