VLAN hopping and why segmentation fails

Objective 4.1 · Attacks and Exploits · 35% of the exam

Objective 4.1 in this course covers network attacks — CompTIA describes it as performing VLAN hopping, on-path attacks and service exploitation. This opens Domain 4, which is 35% of PT0-003 and the largest domain in any course in this series. Everything in this domain runs against the lab you built in lesson 2. No lesson here names a target, and the reason is in LAB-SAFETY.md: a published target is an instruction thousands of readers may follow at a host that never agreed to it.

Why this matters

Segmentation is the control organisations most often claim and least often verify. "That network is isolated" appears in architecture documents, compliance scopes and risk registers, and it is frequently a statement about intent rather than configuration.

Testing it is unusually valuable because the finding is binary and the consequence is large: if the cardholder segment is reachable from the office network, the compliance scope was wrong, and everything built on it was too.

The lesson

What a VLAN does and does not separate

A VLAN separates broadcast domains at layer 2. Devices in different VLANs cannot reach each other directly at that layer; traffic between them must pass through something operating at layer 3.

What follows, and what people get wrong:

  • A VLAN is not a security boundary by itself. It is a traffic-separation mechanism. The security comes from what happens at the layer 3 device connecting them — if that router passes everything, the VLANs are segregated and not isolated.
  • "Different VLAN" therefore does not mean "cannot reach". The test is what the routing and filtering between them permit, which is an empirical question.
  • Management planes cross VLANs by design. The switch itself is usually reachable from a management VLAN, and compromising it makes the whole scheme moot.

So the assessment question is never "are these on different VLANs" but "what can actually reach what", answered by testing rather than by reading the diagram.

Switch spoofing and double tagging, in your own lab

Two classic techniques, both examinable, both demonstrable on your own equipment.

Switch spoofing exploits automatic trunk negotiation. A trunk port carries all VLANs; an access port carries one. Where a switch is configured to negotiate that role automatically, a device can present itself as a switch, negotiate a trunk, and thereby receive traffic for every VLAN the trunk carries. The fix is to disable automatic negotiation and configure access ports explicitly as access ports.

Double tagging exploits how a trunk's native VLAN is handled. A frame carrying two VLAN tags can have the outer one stripped by the first switch and the inner one acted on by the second, placing the frame in a VLAN the sender should not reach. It is one-way — replies do not come back the same route — which makes it useful for injection rather than interaction. The fix is to ensure the native VLAN is not one carrying real traffic, and to tag it explicitly.

Both need managed switching to demonstrate properly, which in a home lab usually means virtual switching in the hypervisor from lesson 2, or an inexpensive managed switch used only for the lab.

Native VLAN mistakes that make hopping possible

The native VLAN is the untagged VLAN on a trunk, and it is where the misconfigurations cluster:

  • The native VLAN matching a VLAN in use, so untagged frames land somewhere real. This is the precondition for double tagging.
  • The native VLAN left at its default everywhere, which makes an attacker's guess reliable.
  • Mismatched native VLANs at each end of a trunk, which silently bridges two VLANs — a segmentation failure that no diagram shows.
  • Unused ports left in a live VLAN and enabled, so physical access to a socket is access to that segment.

These are configuration findings, and they are worth reporting even where you could not demonstrate a hop: the condition is the vulnerability.

Testing a segmentation claim a client has made

This is the engagement-shaped version, and it is often the most valuable single test in a network engagement.

  1. Get the claim in writing. Which segments, and what is asserted — usually "no traffic from A to B except via the firewall".
  2. Establish where you are. Confirm your own VLAN and addressing, so you can describe your position accurately.
  3. Test reachability systematically from A towards B: which addresses respond, which ports are reachable, which protocols pass. Absence of a response is not absence of a path (lesson 19), so test several ways.
  4. Test both directions. Rules are often asymmetric, and B towards A is frequently the one nobody considered.
  5. Record exactly what you tested, because "we could not reach B" must be scoped to what you tried.

A clean result is a finding worth reporting positively — segmentation verified from this position, by these tests, on this date. Clients rarely get told what is working, and it is what makes the negative findings credible.

The configuration change that closes it

Every finding in this domain ends with remediation at the level of the cause (lesson 41), and here it is concrete and cheap:

  • Disable automatic trunk negotiation. Configure ports explicitly as access or trunk; nothing negotiates.
  • Set the native VLAN to an unused one, and tag it explicitly on trunks.
  • Restrict trunks to the VLANs they must carry, rather than all.
  • Shut down unused ports, and place them in an unused VLAN.
  • Keep management off the user VLANs, on its own segment with its own access control.
  • Verify with a test rather than a diagram, on a schedule — which is the re-test criterion lesson 41 asks you to agree in writing.

The point to make in the report: these are configuration changes, not purchases. The remediation cost is small and the risk it removes is the assumption everything else was built on.

What to take into the exam

  • A VLAN separates broadcast domains; isolation depends on the layer 3 device between them. "Different VLAN" does not mean "cannot reach".
  • Switch spoofing abuses automatic trunk negotiation; double tagging abuses the native VLAN and is one-way.
  • Native VLAN misconfigurations are findings in themselves, even without a demonstrated hop.
  • Test a segmentation claim in both directions and record exactly what you tried; a verified claim is worth reporting.
  • Remediation is configuration: no auto-negotiation, unused native VLAN, restricted trunks, shut unused ports, management on its own segment.

Practise what you just read

1. What does a VLAN actually separate?

Select one

  1. Broadcast domains at layer 2, so traffic between VLANs must pass through a layer 3 device
  2. The physical cabling of a network, so that two devices in different VLANs are guaranteed to be plugged into entirely separate switches that share no hardware of any kind between them
  3. The encryption keys used by each device, so traffic in one VLAN cannot be read in another
  4. The internet-facing hosts from the internal ones, which is why a VLAN is a firewall
Show answer

A. A VLAN separates broadcast domains at layer 2; devices in different VLANs cannot reach each other directly at that layer, and traffic between them must pass through something at layer 3. The security depends on that layer 3 device, not the VLAN itself.

2. Why is a VLAN not a security boundary on its own?

Select one

  1. Because a VLAN can only ever hold a single device at a time before it must be split
  2. Because it is a traffic-separation mechanism, and the security comes from the layer 3 device between VLANs
  3. Because a VLAN automatically shares all of its traffic with every other VLAN that happens to be configured on the very same physical switch regardless of the routing between them
  4. Because VLANs are invisible to routers and therefore cannot be filtered at all
Show answer

B. A VLAN is a traffic-separation mechanism; the security comes from what the layer 3 device connecting the VLANs does. If that router passes everything, the VLANs are segregated but not isolated, so the boundary is the router's filtering, not the VLAN.

3. What is the real assessment question about two segments?

Select one

  1. Whether the two segments are configured on different VLAN numbers in the switch
  2. Whether the network diagram shows a firewall drawn between the two segments
  3. What can actually reach what, answered by testing rather than by reading the diagram
  4. Whether the client's architecture document formally asserts that the two segments are isolated from one another for the purposes of their compliance scope and risk register
Show answer

C. The assessment question is never whether hosts are on different VLANs but what can actually reach what, and that is an empirical question answered by testing. Reading the diagram tells you the intent; testing the routing and filtering tells you the reality.

10 more questions on this objective are part of the full course.

Practise the full question bank in the exam simulator

Hands-on labs

All hands-on labs

Part of the free CompTIA PenTest+ PT0-003 course — 41 lessons and 62 hands-on labs.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.