VLAN Hopping by Double Tagging

The first switch strips off the first tag and sends it

The first switch strips off the first tag and sends it

Note: This attack works only if the trunk has the same native VLAN as the attacker.

Victim (VLAN 20)

Note: This attack works only if the trunk has the same native VLAN as the attacker.

• The attacker sends double-encapsulated 802.1Q frames.

• The switch performs only one level of decapsulation.

• Only unidirectional traffic is passed.

• The attack works even if the trunk ports are set to "off".

Note: There is no way to execute these attacks unless the switch is misconfigured.

Victim (VLAN 20)

The double tagging (or double-encapsulated) VLAN hopping attack takes advantage of the way that hardware on most switches operates. Most switches perform only one level of IEEE 802.1Q decapsulation and allow an attacker, in specific situations, to embed a hidden 802.1Q tag inside the frame. This tag allows the frame to go to a VLAN that the outer 802.1Q tag did not specify. An important characteristic of the double-encapsulated VLAN hopping attack is that it works even if trunk ports are set to "off."

A double-tagging VLAN hopping attack follows these four steps:

Step 1 The attacker sends a double-tagged 802.1Q frame to the switch. The outer header has the VLAN tag of the attacker, which is the same as the native VLAN of the trunk port. (For the purposes of this example, assume VLAN 10.) The inner tag is the victim VLAN, VLAN 20.

Step 2 The frame arrives on the switch, which looks at the first 4-byte 802.1Q tag. The switch sees that the frame is destined for VLAN 10 and sends it out on all VLAN 10 ports (including the trunk), because there is no Content Addressable Memory (CAM) table entry. At this point, the second VLAN tag is still intact and has not been inspected by the first switch.

Step 3 The frame arrives at the second switch but has no knowledge that it was supposed to be for VLAN 10. (Native VLAN traffic is not tagged by the sending switch as specified in the 802.1Q specification.)

Step 4 The second switch looks at only the 802.1Q tag (the former inner tag that the attacker sent) and sees that the frame is destined for VLAN 20 (the victim VLAN). The second switch sends the packet on to the victim port or floods it, depending on whether there is an existing CAM table entry for the victim host.

The figure illustrates the attack. It is important to note that this attack is unidirectional and works only when the attacker and trunk port have the same native VLAN. Thwarting this type of attack is not as easy as stopping basic VLAN hopping attacks. The best approach is to ensure that the native VLAN of the trunk ports is different than the native VLAN of the user ports.

© 2006 Cisco Systems, Inc. Securing LAN and WLAN Devices 3-19

Continue reading here: Mitigates STP manipulation with guard root command

Was this article helpful?

+1 -1