VLAN Double Tagging Attack

How VLAN Double Tagging Works

A VLAN double tagging attack abuses how many switches process 802.1Q tags on trunk links. The attacker crafts a frame with two VLAN headers so the first switch strips only the outer tag and forwards the traffic using the inner tag.

This is not a routing problem or an application-layer bypass. It is a Layer 2 segmentation abuse that depends on how the attacker’s ingress port, the trunk path, and the native VLAN are configured.

Why It Can Cross Segmentation Boundaries

The attack matters because VLANs are often used to separate user, server, voice, and management networks. If an edge port can send tagged traffic or if the native VLAN is weakly controlled, the frame can emerge in a VLAN the sender should not reach.

That makes the weakness dangerous in environments that assume VLAN membership alone provides trust boundaries. A successful tag-stripping sequence can expose internal services that were meant to stay isolated behind switch-level segmentation.

At a practical level, the risk increases when trunking is broader than necessary, unused VLANs are left active, or native VLAN handling is inconsistent across switches. The issue is usually one of boundary enforcement, not packet content.

How Organisations Reduce Exposure

Exposure checks start with switch inventory and port role review. Organisations should confirm which ports are access ports, which are trunks, which VLANs are allowed on each trunk, and whether any edge ports can negotiate or transmit tags unexpectedly.

Hardening is strongest when the native VLAN is not used for ordinary user traffic, trunking is explicitly constrained, and unused ports are disabled or placed into a harmless VLAN. These are baseline measures for preventing the first switch from treating attacker-supplied tags as legitimate forwarding metadata.

The Layer 2 Attacks Guide is a useful companion for this topic because it places VLAN hopping, double tagging, ARP spoofing, DHCP spoofing, and switch hardening in one defensive model.

For broader control alignment, NIST Cybersecurity Framework 2.0 supports this kind of network-segmentation control under protect, detect, and recover activities, while NIST SP 800-207 Zero Trust Architecture reinforces the idea that network location alone should not be treated as proof of trust.

Detection, Investigation, and Post-Compromise Review

Detection is difficult because the attack can look like ordinary Layer 2 forwarding, but defenders can still review trunk configuration drift, unexpected VLAN membership, and traffic appearing on segments that should not source it. Switch logs, configuration audit data, and north-south monitoring all help establish whether segmentation has been crossed.

If exploitation is suspected, review whether sensitive VLANs were reachable from an access port, whether the native VLAN was shared with user traffic, and whether any management or server segments may have been exposed. The next question is not only whether the frame got through, but what systems were reachable once it did.

Where the compromise reached protected networks, the response should include a review of services, credentials, and administrative paths accessible from the affected VLAN. The issue is often a pivot point into a larger internal trust zone rather than a standalone packet anomaly.

For threat-led investigation, the MITRE ATT&CK Enterprise Matrix is useful for mapping how an initial network foothold can support lateral movement, while NIST SP 800-53 Rev 5 Security and Privacy Controls gives practitioners a control vocabulary for access control, audit logging, and system integrity.

Risk and Threat Considerations

Double tagging is attractive to attackers because it targets a trust assumption that is often left implicit: that VLAN boundaries cannot be crossed from an access port. When trunking and native VLAN settings are weak, the boundary itself becomes the weakness.

Failure mechanism: A switch removes only the outer VLAN tag, then forwards the frame with the inner tag still intact, allowing the packet to land in a different VLAN than the sender should have reached.

Impact: Segmented systems can become reachable from an untrusted edge location, which can expose internal services, broaden lateral movement options, and undermine the integrity of the network design.

Practitioner Guidance

Why practitioners should care: Treat VLAN double tagging as a segmentation-control failure, not just a niche switching issue. If your network design relies on VLANs for isolation, this attack tests whether those boundaries are actually enforced at the edge.

What to watch for: Pay close attention to trunk exposure, native VLAN usage, and ports that can send tagged frames when they should not. Those are the conditions that turn a theoretical Layer 2 trick into a real cross-VLAN path.

Practitioner takeaway: The safest posture is to make edge ports unambiguous, keep trunks minimal, and ensure that segmentation does not depend on default switch behaviour.

Related resources from NHI Mgmt Group

• Attack Surface Management
• Who is accountable when recovery controls fail during a double-extortion attack?
• What happens when a ransom payment is made after a double-extortion attack?
• How can security teams detect a double-spend attack?