VLANs and 802.1Q Explained: Tagging, Trunks & VLAN Hopping (Animated)

VLANs let one set of switches carry several separate networks: staff, finance, guests, cameras. Between switches, frames carry a small 802.1Q tag saying which VLAN they belong to. VLAN separation is a key security boundary, so misconfigurations matter.

1. Access port: the pc doesn’t know about vlans

The staff PC sends ordinary frames. The switch knows the port belongs to VLAN 10.

1. FRAME (Staff PC → Access switch): No tag yet.

Wireshark filter:

eth

2. Trunk tagging: tags between switches

On the trunk to the core, the switch adds an 802.1Q tag. The core only lets VLAN 10 talk to VLAN 20 if a firewall rule allows it.

1. 802.1Q (Access switch → Core switch / firewall): The tag travels on the trunk.
2. ROUTED (Core switch / firewall → Finance server): Traffic between VLANs passes through policy.

Wireshark filter:

vlan.id == 10

3. Vlan hopping: attack: turning a desk port into a trunk

If a desk port is left in automatic trunking mode, a device can negotiate a trunk with the switch (switch spoofing). The port then carries every VLAN, and the attacker can talk directly inside the finance VLAN without passing the firewall rules.

1. DTP (Attacker → Access switch): The desk port is asked to become a trunk.
2. DTP (Access switch → Attacker): The switch agrees.
3. 802.1Q (Attacker → Finance server): The attacker sends frames straight into the finance VLAN.

Wireshark filter:

dtp

4. Lock the ports: defence: access mode, no negotiation

Set every user port to access mode with DTP off, use a dedicated unused native VLAN on trunks, only allow the VLANs each trunk needs, and shut unused ports.

1. DTP (Attacker → Access switch): The port stays an access port in VLAN 10.

Switch config (cisco):

interface range Gi1/0/1-44
 switchport mode access
 switchport nonegotiate
trunk: switchport trunk native vlan 999

FAQ