Bridge two VLANs by a native-VLAN mistake, then close it

short · 55 min · Objective 4.1

Task

Configure two VLANs on virtual switching you own, create the native-VLAN misconfiguration that lets a frame reach a VLAN it should not, observe it, and then apply the configuration change that closes it. A VLAN separates broadcast domains; whether it isolates depends on configuration you can test.

Steps

  1. On the lab you own, create two VLANs — 10 and 20 — with a trunk between two virtual switches, and a host in each.
  2. Introduce the mistake: set the trunk's native VLAN to VLAN 10, a VLAN in use, and leave it untagged.
  3. From the VLAN 10 host, send a double-tagged frame (outer 10, inner 20) and confirm it reaches the VLAN 20 host — the outer tag is stripped by the first switch and the inner acted on by the second.
  4. Note it is one-way: replies do not return by the same route.
  5. Apply the fix: set the native VLAN to an unused VLAN, tag it explicitly, and restrict the trunk to the VLANs it must carry. Repeat step 3 and confirm the frame no longer arrives.
  6. Record both results.

Verify

tshark -r /tmp/before.pcap -Y "vlan" -T fields -e vlan.id 2>/dev/null | sort -u
grep -ciE "reached|arrived|vlan 20|received" /tmp/hop-result.md
grep -ciE "native.*unused|tagged|no longer|blocked|restrict" /tmp/hop-result.md

The first line shows the VLAN tags present in your capture — the double tag is the mechanism. The second must be non-zero: you recorded the frame reaching VLAN 20 while the misconfiguration was in place. The third must be non-zero: you recorded the fix working — after setting an unused native VLAN and tagging it, the hop stops. The before-and-after is the finding.

Notes

Native-VLAN misconfigurations are findings in themselves, even without a demonstrated hop: a native VLAN matching one in use, left at default, or mismatched at each end of a trunk all silently bridge segments no diagram shows. Switch spoofing is the other route, abusing automatic trunk negotiation. Remediation is configuration, not purchase — the cost is small and it removes an assumption everything else was built on. All of this ran on switching you own.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.