Lion Cipher Lab

See VLAN hopping happen with 802.1Q double tagging — then shut it down

• Cyber / Security Engineer
• Intermediate
• ~60 min
• Free · no account required

Why it matters

VLANs are how almost every office, campus and data centre is carved into zones: guests here, cameras there, the finance subnet somewhere you are not supposed to reach. People treat a VLAN boundary like a wall. Double tagging is the classic demonstration that one specific misconfiguration turns that wall into a one-way letterbox: a host on the trunk's 'native' VLAN can push a frame into another VLAN without any router, firewall or routing between them. It is a favourite exam and interview topic precisely because you cannot really understand it from a diagram — you have to see the outer tag get…

What you'll learn

• what a VLAN is, what an 802.1Q tag is, and what a trunk's 'native VLAN' means
• how the 802.1Q double-tagging attack jumps a frame across a VLAN boundary, and why it is one-way
• building two VLAN-filtering Linux bridges, a trunk and endpoints from veth + network namespaces in one container
• crafting a double-tagged Ethernet frame by hand with a Python stdlib AF_PACKET raw socket (no scapy)
• reading 802.1Q tags in tcpdump and proving an injection landed in the wrong VLAN
• shutting the attack down two ways — move the native VLAN to an unused id, and prune/tag the trunk — and measuring each
• the honest limits: this is a faithful model of the native-VLAN mechanism, not a Cisco switch, and switch-spoofing via DTP is a separate vector

Steps in this lab

1. The idea in plain language: VLANs, 802.1Q tags, trunks and the native VLAN
2. The attack in one sentence, before you build it
3. Start a throwaway privileged container and install the tools
4. Build two switches, a trunk, an attacker and a victim
5. Configure the VULNERABLE VLAN layout (native VLAN 1 = the attacker's VLAN)
6. Craft the double-tagged frame with a Python raw socket (no scapy)
7. Fire it and watch the hop land in the victim VLAN
8. Prove it is ONE-WAY: the attacker never hears back
9. Defence 1: move the native VLAN to an unused id — measure it
10. Defence 2: tag everything / prune the victim VLAN off the trunk — measure it
11. The other VLAN-hop vector you did NOT build: switch spoofing via DTP
12. How the Linux steps map to a real managed switch
13. Honest limits of this lab

Open the full interactive lab →