Double Tagging is the attack that adds two VLAN tags to frames (outer and inner) to perform what type of attack?

• A. Switch Spoofing
• B. ARP Poisoning
• C. Teredo
• D. Double Tagging

Answer: (D)

Double tagging is a method used to move traffic between VLANs, a VLAN hopping technique. On a trunk link, frames are tagged with a single 802.1Q VLAN tag to indicate which VLAN they belong to. In a double-tagging attack, the attacker sends frames with two tags: an outer tag that places the frame on the attacker’s VLAN on the trunk, and an inner tag that specifies another VLAN (the victim’s VLAN) inside the frame. When switches along the path process the frame, the outer tag is stripped to determine how to forward it on the trunk, but the inner tag remains and directs the frame into the target VLAN. The result is that traffic from one VLAN can be received or manipulated in another VLAN, bypassing the expected VLAN separation. This is different from attacks like ARP poisoning or Teredo, which operate through different mechanisms. To defend against it, configure trunk ports carefully, limit which VLANs can pass over each trunk, disable dynamic trunk negotiation, and ensure the native VLAN handling is consistent.