Another type of land hopping attack is known as double tagging attack.
This type of attack takes advantage of the way that hardware on most switches operate, most switches
perform only one level of Aido to one cue D encapsulation, which allows an attacker to embed a hidden
Aido to one cue tag inside the frame.
This tag allows the frame to be forwarded to a VLAN that the original Aido to one cue tag did not specify.
An important characteristic of the double tagging VLAN hopping attack is that it works even if trunked
ports are disabled because a host typically sends a frame on a segment that is not a trunk link.
So let's see how the double tagging van hopping attack is performed step by step.
The attacker sends a double tagged Aido to dot one keyframe to the switch.
The outer header has the villain tag of the attacker, which is the same as a native villain of the
trunk port.
Normally, a switchboard configured as a trunk port sends and receives VLAN tagged Ethernet frames,
native VLAN is the only VLAN, which is not tagged in a trunk.
In other words, native VLAN frames are transmitted untagged.
The assumption here is that the switch process is the frame received from the attacker as if it were
on a trunk board.
In this example, native land is villain one.
The entire tag is the victim villain.
In this case, it's villain 20.
The frame arrives on the switch, which looks at the first four byte, eight to one cue tag.
The switch sees that the frame is destined for villain one, which is a native villain.
The switch forwards the packet out on all Vilan one Bortz after stripping the vivants Montag.
On the trunk port, the VLAN one tag is stripped and the packet is not red tagged because it's part
of the native VLAN at this point, the VLAN 20 tag is still intact and it has not been inspected by
the first switch.
The second switch looks only at the inner eight to one cue tag that the attacker sent, and so you see
the frame is destined for VLAN 20, the target VLAN.
The second switch sends the frame onto the victim port or floods it, depending on whether there is
an existing MAC address, table entry for the victim's host.
So the best approach to mitigating double tagging attacks is to ensure that the native land of the trunk
ports is different from the VLAN of any user ports.
Right.
In other words, do not let the users use their native land.
In fact, it's considered a security best practice to use a fixed VLAN that is distinct from all user
villans in the switch network as a native VLAN for all eight to one key trunk's.