Examkin

Question

Difficulty: MediumCommon Network Attack Types and Vectors

A network administrator observing traffic on a managed switch detects unauthorized Ethernet frames originating from a host on VLAN 10 arriving at a server isolated on VLAN 20 without passing through an intervening router. Packet analysis shows that the frames contain two 802.1Q headers: an outer tag corresponding to VLAN 10 (the native VLAN of the trunk link) and an inner tag specifying VLAN 20. Which of the following attack types is being executed?

  1. Double-tagging VLAN hoppingAnswer
  2. B
    Address Resolution Protocol (ARP) poisoning
  3. C
    Domain Name System (DNS) record redirection using CNAME records
  4. D
    Telnet-to-SSH service port redirection

Answer

Double-tagging VLAN hopping
Double-tagging VLAN hopping exploits how switches process native VLAN traffic on 802.1Q trunks. An attacker crafts a frame containing two 802.1Q tags. When the primary switch receives the frame on an access port configured with the native VLAN, it strips the outer tag and transmits the frame over the trunk. The receiving switch reads the inner tag and forwards the frame to the target VLAN, bypassing Layer 3 security controls.

Step-by-Step Solution

1
Analyze the Ethernet frame headers from the packet capture
The packet contains stacked 802.1Q tags: an outer tag for VLAN 10 and an inner tag for VLAN 20.
When an 802.1Q trunk receives a frame tagged with its native VLAN ID, the switch strips the outer tag before transmitting it across the trunk link.
2
Evaluate how the destination switch interprets the modified frame
The destination switch reads the remaining inner tag (VLAN 20) and forwards the frame directly to the VLAN 20 segment.
This allows one-way traffic injection across VLAN boundaries without traveling through a Layer 3 routing device.
3
Identify the specific network attack technique
The scenario describes double-tagging VLAN hopping.
Double-tagging specifically exploits native VLAN frame processing mechanisms on 802.1Q trunks.

Key Concept

Double-tagging VLAN Hopping
Rate this question

Topics

Common Network Attack Types and Vectors

More questions from this topic