An enterprise network security administrator discovers anomalous traffic on a switch interface where an attacker on VLAN 10 sent frames directly to a target server on VLAN 20 without passing through a router. Analysis of captured frames reveals two 802.1Q tags embedded within the Ethernet header. Which of the following conditions must be met for this double-tagging VLAN hopping attack to succeed? (Select TWO.)
- The native VLAN of the 802.1Q trunk link must match the attacker's access VLAN.Cevap
- The traffic must traverse an 802.1Q trunk line connecting two switches.Cevap
- CThe attacker must spoof the target server's MAC address in the local ARP table prior to frame transmission.
- DThe target host must resolve network services using an application-layer CNAME record.
Cevap
Double-tagging VLAN hopping requires that the native VLAN of the trunk link matches the attacker's VLAN, and that the traffic traverses an 802.1Q trunk connecting switches.
A double-tagging attack succeeds when the attacker's access VLAN matches the native VLAN configured on an 802.1Q trunk port. Upon receiving the frame, the first switch strips the outer tag because it matches the native VLAN. The frame travels across the trunk to the second switch, which reads the inner 802.1Q tag and forwards the frame to the target VLAN, bypassing router access controls.
Adım Adım Çözüm
Anahtar Kavram
Double-tagging VLAN hopping exploits native VLAN stripping mechanisms over 802.1Q trunk links to send unidirectional frames to a different VLAN without passing through a Layer 3 device.