ANALYSIS OF PROTECTION EFFECTIVENESS AGAINST DOUBLE TAGGING ATTACKS IN HETEROGENEOUS NETWORK ENVIRONMENTS (CISCO, MIKROTIK, ELTEX)

This paper presents a practical analysis of a VLAN Hopping attack implemented using the Double Tagging technique, which allows attackers to bypass the logical isolation of virtual local area networks based on the IEEE 802.1Q standard. The study examines architectural characteristics of VLAN technology related to native VLAN processing on trunk ports of Ethernet switches that create conditions for exploiting Layer 2 vulnerabilities. The mechanism of forming Ethernet frames with double 802.1Q tagging is described in detail, along with the frame forwarding logic that allows such packets to be delivered into a target VLAN segment without authorization.

The experimental part of the research was conducted on a dedicated testbed using real network equipment from multiple vendors, including Cisco, MikroTik, and Eltex. This heterogeneous environment allows evaluation of device behavior under identical attack conditions. The Yersinia utility was used to generate Ethernet frames with double tagging, while network traffic was captured and analyzed using the tcpdump tool to confirm successful delivery of traffic to a protected VLAN segment.

The study compares device behavior under default configurations and after applying standard security countermeasures. The results demonstrate that the default native VLAN configuration on trunk ports makes network infrastructures vulnerable to Double Tagging attacks regardless of the equipment vendor. Based on the experimental findings, practical recommendations for improving VLAN-based network segmentation security are proposed, including assigning a non-default native VLAN, explicitly configuring port modes, and disabling automatic trunk negotiation mechanisms. The research highlights the critical importance of correct Layer 2 configuration practices for ensuring secure segmentation in modern heterogeneous network environments.