Adam,
To start off, keep in mind that double-tagging starts when an attackers send a frame to a connected switchport with two VLAN tags in the header.
1. Double-tagging allows you to reach the victim a switch away from the attacker.
2. Correct, access ports will accept tagged frames.
If the attacker is connected to an access port as mentioned, it will accept the first tag of the frame.
If the attacker is connected to a Dot1Q trunk, the first tag matches the native vlan. The second tag matches the destination VLAN that is desired for the attack.
Now the switch receives the attackers frames, and the first tag is stripped. Now the second tag is forwarded out all of the switches trunks for the destination VLAN. The second tag was never stripped, so the receiving switch see it and forwards it to the ports that are in that VLAN.
3. Yes, assigning the native to an unused VLAN is one of the mitigation steps.
A few things:
- Remove access ports from default VLAN 1
- Assign the native VLAN to an unused VLAN
Additional considerations:
- ISL encapsulation does not use native VLAN, Dot1Q does.
- All native VLAN traffic can be tagged, therefore disabling untagged traffic
Regards,
Anthony
