Methods and Systems of Information Protection, Information Security

SWITCH SPOOFING AND DOUBLE TAGGING IN A CISCO ROUTER-ON-A-STICK LABORATORY CASE

A. A. Aristarkhova , M. V. Chekov
UDC: 004.7 Published: 01.06.2026 Issue: Vol. 2 No. 010 (2026): Professionalitet, 2026 DOI: 10.24412/3033-9359-2026-010-76-83
Download PDF

Abstract

This article describes a Router-on-a-Stick configuration using a Cisco 1941 router and Cisco Catalyst 2960 switch, together with two laboratory episodes using Yersinia: Switch Spoofing and Double Tagging. It records the VLAN and trunk configuration, connection of the attacker host, and packet and port states shown in the manuscript. The experiments concern the stated Cisco setup; a table containing Eltex and MikroTik configurations provides setup examples, not attack results for those devices. The work is not a controlled vendor comparison, reports no repeated trials, and does not measure the overall security of the Router-on-a-Stick architecture. Cisco-focused recommendations are limited to explicit trunk and access port configuration, disabling DTP where it is unnecessary, controlling allowed VLANs, and choosing a dedicated native VLAN subject to device compatibility. Double Tagging depends on tag processing and native-VLAN conditions and should not be treated as an inevitable consequence of Router-on-a-Stick itself. The results illustrate one case and do not establish behavior on other models or software versions. The study does not compare software releases, provide repeated control trials, or assess operational risk in other topologies. Configuration examples were checked against IEEE 802.1Q and the switch and router vendors’ documentation [1–7].

Online viewer

References

  1. IEEE. (2022). IEEE Standard for Local and Metropolitan Area Networks—Bridges and Bridged Networks (IEEE 802.1Q-2022). Retrieved October 12, 2026, from https://standards.ieee.org/ieee/802.1Q/10323/.
  2. Cisco. (n.d.). Configure VLAN Trunking, Cisco IOS XE 17. Retrieved October 12, 2026, from https://www.cisco.com/c/en/us/td/docs/switches/lan/c9000/lyr2-fwd/vlan/vlan-configuration-guide/configure-vlan-trunks.html.
  3. Cisco. (n.d.). Catalyst 2960 configuration guide: Configuring VLAN Trunks. Retrieved October 12, 2026, from https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/15-2_3_e/consolidated_guide/b_1523e_2960p_2960c_cg/b_1522e_2960_2960c_2960s_2960sf_2960p_cg_chapter_01101.html.
  4. Cisco. (n.d.). Campus Network for High Availability Design Guide: Preventing Double 802.1Q Encapsulated VLAN Hopping. Retrieved October 12, 2026, from https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Campus/HA_campus_DG/hacampusdg.html.
  5. MikroTik. (n.d.). Bridge VLAN Table: RouterOS Documentation. Retrieved October 12, 2026, from https://help.mikrotik.com/docs/spaces/ROS/pages/28606465/Bridge%20VLAN%20Table.
  6. Eltex. (n.d.). MES: Configuring a switch port in Trunk mode. Retrieved October 12, 2026, from https://docs.eltex-co.ru/pages/viewpage.action?pageId=619644036.
  7. Cisco. (n.d.). Configure Inter-VLAN Routing with the Use of an External Router. Retrieved October 12, 2026, from https://www.cisco.com/c/en/us/support/docs/lan-switching/inter-vlan-routing/14976-50.html.

License

Copyright (c) 2026 A. A. Aristarkhova, M. V. Chekov (Author)

Creative Commons Attribution (CC BY) 4.0

Keywords

Router-on-a-Stick Cisco Catalyst VLAN DTP Switch Spoofing Double Tagging