Layer 2 Attacks Guide: VLAN Hopping, ARP Spoofing and MAC Flooding

Ethernet switching was designed to trust every device on the wire, so anyone who can plug into an access port or compromise one host can often redirect, flood or eavesdrop on traffic for the whole VLAN. Layer 2 attacks such as VLAN hopping, ARP spoofing, MAC flooding, rogue DHCP and spanning tree manipulation need no exploit, only default switch settings. This guide explains how each works at concept level, where it shows up, how to detect it and which switch features close it: port security, DHCP snooping, dynamic ARP inspection, IP Source Guard, 802.1X, native VLAN practice and BPDU guard. It is written for network engineers and security teams hardening campus and data centre switching. Segmentation design and NAC platforms are covered in their own guides and only referenced here.

Key takeaways

• Defaults are the vulnerability. Negotiated trunks, VLAN 1 as native VLAN, unauthenticated ports and untrusted DHCP and ARP are what Layer 2 attacks rely on.
• DHCP snooping is the foundation. Its binding table feeds dynamic ARP inspection and IP Source Guard, so deploy it first.
• Every access port should be an edge port. Static access mode, BPDU guard, port security or 802.1X, and storm control on every host-facing port.
• Layer 2 attacks are local but not harmless. They give an attacker on one host a man-in-the-middle position for credentials and sessions across the segment.
• Switch logs are the detector. DAI drops, port security violations, err-disabled ports and root changes are high-signal events that most SOCs never collect.

How the attack works

Each attack abuses a protocol that assumes neighbours are honest. The descriptions below explain the mechanism so defenders can recognise it; they are not procedures.

VLAN hopping

• Switch spoofing: if an access port is left to negotiate trunking (for example Cisco DTP in dynamic mode), a host that pretends to be a switch can form a trunk and receive traffic for every VLAN allowed on it.
• Double tagging: an attacker on the same VLAN as a trunk's native (untagged) VLAN sends a frame with two 802.1Q tags. The first switch strips the outer tag because it matches the native VLAN and forwards the frame on the trunk, where the next switch reads the inner tag and delivers it into another VLAN. It works in one direction only, but that is enough to reach a target.

ARP spoofing (ARP poisoning)

ARP has no authentication. A host can send unsolicited ARP replies claiming that the default gateway's IP address belongs to its own MAC address. Victims update their caches and send traffic through the attacker, who forwards it on. MITRE ATT&CK tracks this as T1557.002 ARP Cache Poisoning under T1557 Adversary-in-the-Middle.

MAC flooding

A switch learns source MAC addresses into a fixed-size table (the CAM table). Flooding it with frames from thousands of random source addresses fills the table, after which the switch floods unknown unicast traffic out of every port in the VLAN, much like a hub, exposing traffic to a listening host. CAPEC-125 Flooding describes the general pattern.

DHCP spoofing and starvation

A rogue DHCP server answers client requests faster than the real one and hands out its own address as gateway or DNS server, placing itself in the path (T1557.003 DHCP Spoofing, CAPEC-697). Starvation exhausts the legitimate server's address pool with requests from forged MAC addresses, so clients only get leases from the rogue server.

Spanning tree (STP) manipulation

STP elects a root bridge from bridge protocol data units (BPDUs). A device on an access port that sends BPDUs with a better priority can become root, pulling traffic through itself or causing topology changes and outages. A looped unmanaged switch can do the same accidentally.

Where it shows up

• Open office and meeting room ports: live wall ports with no authentication let any visitor or contractor reach the user VLAN.
• Compromised endpoints: malware on one workstation can poison ARP for the whole subnet without physical access, which is why these attacks matter after phishing, not just for insiders.
• Voice VLANs: IP phones with a PC pass-through port carry a voice VLAN and a data VLAN on one access port. Unauthenticated phone ports are a common route into the voice VLAN.
• Flat server and OT networks: large shared VLANs with mixed trust levels let one compromised host intercept others. Private VLANs or segmentation reduce this. See the Network Segmentation Guide.
• Guest and hospitality Wi-Fi: wireless clients on a shared broadcast domain face the same ARP and DHCP risks unless client isolation is on.
• Virtual switches: hypervisor and cloud virtual switches have their own equivalents (MAC address change and forged transmit settings, port groups); the same principles apply.

Impact

• Credential and session theft: a man-in-the-middle position exposes any cleartext protocol and enables relay or downgrade attempts against weak authentication on the segment.
• Segmentation bypass: VLAN hopping undermines VLANs used as a security boundary, for example between user, management and payment networks.
• Traffic redirection: rogue DHCP can point clients at an attacker-controlled DNS resolver for the life of the lease.
• Availability: STP manipulation, broadcast storms and DHCP starvation can take down a site's network.

Encryption limits the damage but does not remove it: TLS, SSH, SMB signing and LDAP signing make intercepted traffic far less useful, which is one reason to enforce them on internal networks too.

Detection

Forward switch syslog and SNMP traps to the SIEM and alert on the high-signal events above. Note that port security in protect mode drops traffic silently with no log, which hides attacks. See the Network Monitoring and Packet Capture Guide and the NDR Guide.

Metrics that show it is working:

• Percentage of access ports in static access mode with BPDU guard enabled (target 100%).
• Percentage of user VLANs with DHCP snooping and DAI enabled.
• Percentage of access ports enforcing 802.1X or MAB with a defined fallback policy.
• Number of trunks with VLAN 1 as native VLAN or with negotiation enabled (target zero).
• Mean time to investigate err-disabled ports and DAI drop alerts.
• Configuration drift findings against the switch baseline per quarter.

Prevention and hardening

Switch features and what they stop

• Port security: limits the MAC addresses learned on a port. Cisco defaults are disabled, one secure address and shutdown on violation; addresses can be static, dynamic or sticky. Use restrict or shutdown, not protect, so violations are logged. NSA notes port security is hard to manage at scale and can be bypassed by MAC spoofing, so treat it as a fallback where 802.1X is not possible.
• DHCP snooping: all ports untrusted by default; only uplinks towards real DHCP servers are trusted. The switch drops server messages (DHCPOFFER, DHCPACK) arriving on untrusted ports and builds a binding table of MAC, IP, lease, VLAN and interface. Add a per-port DHCP rate limit to slow starvation.
• Dynamic ARP inspection: checks ARP packets on untrusted ports against the DHCP snooping bindings and drops mismatches. Optional validation checks source MAC, destination MAC and invalid IP addresses. Use ARP ACLs for statically addressed hosts such as printers and servers.
• IP Source Guard: filters traffic on untrusted ports to source addresses in the binding table (IP only, or IP plus MAC). Requires DHCP snooping on the access VLAN.
• 802.1X: IEEE 802.1X-2020 defines port-based network access control: the port stays closed until the device authenticates with EAP over LAN, and MACsec Key Agreement can enable IEEE 802.1AE encryption on the link. NSA recommends 802.1X with device certificates as the more robust option. See the Network Access Control (NAC) Guide.
• BPDU guard and root guard: BPDU guard err-disables a PortFast port that receives a BPDU; root guard places a port in a root-inconsistent state if it receives a superior BPDU and recovers automatically when they stop. Use BPDU guard on all host-facing ports and root guard on ports facing switches that must never become root. Add loop guard on non-designated ports.
• Storm control: caps broadcast, multicast and unknown unicast rates on host-facing ports, limiting floods and loops.
• Private VLANs: isolated ports talk only to promiscuous ports (gateway, firewall), and community ports talk to their community and promiscuous ports, giving Layer 2 isolation within one subnet. Useful for server farms, DMZs and guest networks.

VLAN and trunk practice

The DISA Layer 2 Switch Security Requirements Guide gives a clear baseline:

• Configure trunks statically, never negotiated (V-206665), and set access ports to static access mode.
• Use a native VLAN other than VLAN 1 on trunks (V-206671) and assign no switch ports to the native VLAN (V-206672).
• Keep the default VLAN off host-facing ports (V-206667), prune it from trunks that do not need it (V-206668) and do not use it for management (V-206669).
• Assign disabled ports to an unused VLAN (V-206666) and shut them down.
• Enable DHCP snooping (V-206658) and DAI (V-206660) on user VLANs, IP Source Guard (V-206659), BPDU guard (V-206655), root guard (V-206654), loop guard (V-206656) and storm control (V-206661).
• Allow only required VLANs on each trunk (VLAN pruning) and disable CDP and LLDP where not needed, as NSA recommends.

Rollout order

1. Inventory: export switch configurations, list trunks, native VLANs, DHCP servers, statically addressed hosts and ports with phones or downstream switches.
2. Quick wins: static access mode, shut unused ports into a dead VLAN, change native VLAN, BPDU guard on edge ports. Low risk, apply site by site.
3. DHCP snooping: enable per VLAN, trust uplinks, let the binding table populate for at least a full lease period before relying on it.
4. DAI and IP Source Guard: pilot on one VLAN, add ARP ACLs for static hosts, watch drop logs, then expand. Roll back by disabling inspection on that VLAN if legitimate hosts drop.
5. 802.1X: start in monitor (open or low-impact) mode, fix failing devices, then move to closed mode per site. Keep a documented fallback for devices that cannot authenticate.
6. Baseline and drift: codify the settings in templates and check every switch against them on a schedule.

Decision guidance

• 802.1X or port security: 802.1X wherever devices can support it; port security with sticky addresses for small sites, fixed devices and where no RADIUS infrastructure exists.
• Small organisations: the quick wins plus DHCP snooping and BPDU guard give most of the protection with modest effort, even without NAC.
• Large estates: automate configuration templates and compliance checks; manual per-switch hardening drifts within months.
• Private VLANs or microsegmentation: private VLANs for simple same-subnet isolation; host or identity-based segmentation where policy must follow workloads.

Framework mapping

Practitioner checklist

• Set every host-facing port to static access mode and configure trunks statically.
• Move native VLANs off VLAN 1, keep them empty, and prune unneeded VLANs from trunks.
• Shut unused ports and assign them to an unused VLAN.
• Enable DHCP snooping on user VLANs with only server-facing uplinks trusted.
• Enable dynamic ARP inspection and IP Source Guard after the binding table is stable, with ARP ACLs for static hosts.
• Enable BPDU guard on edge ports, root guard towards access switches and storm control on host ports.
• Deploy 802.1X (monitor mode first) and use port security in restrict or shutdown mode where 802.1X cannot be used.
• Forward switch syslog and SNMP traps to the SIEM and alert on DAI drops, violations, err-disable and root changes.
• Check switch configurations against a written baseline every quarter.

Standards and references

• IEEE: 802.1X Port-Based Network Access Control
• NIST: SP 800-53 Rev. 5
• NSA: Network Infrastructure Security Guidance
• DISA: Layer 2 Switch Security Requirements Guide
• Cisco: Layer 2 Security Features on Catalyst Switches
• Cisco: Spanning Tree Protocol Root Guard Enhancement
• Cisco: Troubleshoot Dynamic ARP Inspection
• MITRE ATT&CK: ARP Cache Poisoning

Related NHI Mgmt Group resources: Network Segmentation Guide · Network Access Control (NAC) Guide · Top 10 Network Security Misconfigurations · Lateral Movement Guide