‫Another type of island hopping attack is known as double tagging attack.
‫This type of attack takes advantage of the way that hardware on most switches operates, most switches
‫perform only one level of 8.2.1 que d encapsulation, which allows an attacker to embed a hidden eight
‫to one Q tag inside the frame.
‫This tag allows the frame to be forwarded to a villain that the original eight on Q Tag did not specify.
‫An important characteristic of the double tagging villain hopping attack is that it works even if trunk
‫ports are disabled because a host typically sends a frame on a segment that is not a trunk link.
‫So let's see how the double tagging van hopping attack is performed.
‫Step by step.
‫The attacker sends a double tagged 8.2.1 Q framed to this, which.
‫The outer header has the velan tag of the attacker, which is the same as a native villain of the trunk
‫port.
‫Normally, a Switch port configured as a trunk port sends and receives land tagged Ethernet frames.
‫Native VLAN is the only villain which is not tagged in a trunk.
‫In other words, native villain frames are transmitted untagged.
‫The assumption here is that the switch process is the frame received from the attacker as if it were
‫on a trunk board.
‫In this example, the native villain as villain one, the inner tag is the victim villain in this case,
‫its villain.
‫20.
‫The frame arrives on the switch, which looks at the first four byte 8.2.1 cue tag.
‫The switch sees that the frame is destined for villain one, which is a native view in.
‫The switch forwards, the pack it out on all the land one ports after stripping the Vive and Montag.
‫On the trunk port, the VLAN one tag is stripped and the packet is not red tagged because it's part
‫of the native velan.
‫At this point, the VLAN toe tag is still intact and it has not been inspected by the first switch.
‫The second switch looks only at the inner 8.2.1 Q tag that the attacker sent and sees that the frame
‫is destined for VLAN 20, the target villain.
‫The second switch sends the frame onto the victim port or flood it, depending on whether there is an
‫existing Mac address table entry for the victim's host.
‫So the best approach to mitigating double tagging attacks is to ensure that the native villain of the
‫trunk ports is different from the villain of any user ports.
‫Right?
‫In other words, do not let the users use their native villain.
‫In fact, it's considered a security best practice to use a fixed villain that is distinct from all
‫user villains in the Switch network.
‫As a native villain for all 8.2.1 Q Trunks.