Layer 2 Threats and Security Features

5 min read

Most security discussions focus on Layer 3 and above — firewalls, access lists, routing — but a surprising number of attacks happen one layer down, at Layer 2, inside the local network itself. If an attacker gets a foothold on the same switch or VLAN as legitimate hosts, several well-known attack techniques become available. This article covers four of the most important ones and the Cisco features used to defend against each.

1. DHCP Spoofing

In a DHCP spoofing attack, the attacker listens for DHCP requests coming from clients on the network and races to answer them with a fake DHCP response before the real DHCP server’s response arrives. A common goal of this attack is to hand out the attacker’s own address as the default gateway, which places the attacker in the middle of the client’s traffic as a man-in-the-middle.

The attacker races the real DHCP server to answer the client’s request first.

Mitigation: DHCP Snooping. This Cisco feature classifies each switch port as either trusted or untrusted. Only ports that connect toward a legitimate DHCP server should be marked trusted, and these are the only ports allowed to send any type of DHCP message, including responses. All other ports are untrusted and are only allowed to send DHCP requests; if a DHCP response is seen coming in on an untrusted port, the switch treats it as an attack and shuts the port down.

DHCP snooping only allows DHCP responses on trusted ports facing the real server.

2. VLAN Hopping

VLAN hopping refers to techniques that let an attacker send or receive traffic on a VLAN they should not have access to, bypassing whatever Layer 3 controls are meant to separate those VLANs. There are two common ways to do this.

a. Switch Spoofing

In this method, the attacker connects a device that pretends to be a switch and sends Dynamic Trunking Protocol (DTP) frames, trying to negotiate a trunk link with the real switch. If this succeeds, the attacker’s port becomes a trunk and gains access to every VLAN carried on that trunk.

Switch spoofing tricks a switch into forming a trunk with the attacker’s device.

Mitigation: Simply disable DTP on access ports, so no port can be negotiated into a trunk in the first place.

b. Double-Tagging Attack

Here, the attacker crafts a frame with two stacked 802.1Q VLAN tags. The outer tag matches the native VLAN of the trunk between switches, while the inner tag is set to the VLAN the attacker actually wants to reach. The first switch strips off the outer tag (because it matches the native VLAN and is, by convention, not tagged going out) and forwards the frame along the trunk still carrying the inner tag. The next switch then reads that inner tag and delivers the frame into the victim’s VLAN.

This attack has an important limitation: it is strictly one-way. There is no way to encapsulate a return packet using the same trick, so the attacker can send traffic into the target VLAN but cannot receive a reply through the same mechanism.

The first switch strips the outer tag; the second switch acts on the inner tag.

Mitigation options:

Use VLAN Access Control Lists (VACLs) to filter traffic within and between VLANs.
Deploy Private VLANs to further restrict communication between ports.
Make sure the native VLAN on every trunk is different from any VLAN actually in use by end users — this alone defeats the double-tagging technique, since it depends on the outer tag matching the native VLAN.

3. ARP Attack (ARP Poisoning / Spoofing)

ARP poisoning exploits a quirk of the ARP protocol: a host is allowed to send a gratuitous ARP reply even when nobody actually sent a matching request. An attacker takes advantage of this by sending forged ARP messages that associate its own MAC address with the IP address of a legitimate host, such as the default gateway. Other devices on the segment update their ARP tables with this false mapping and start sending traffic to the attacker instead of the real destination.

Mitigation: Dynamic ARP Inspection (DAI). DAI validates ARP packets as they pass through the switch, checking them against trusted bindings (typically built from DHCP snooping data) and dropping ARP packets that do not match a legitimate IP-to-MAC binding, which prevents spoofed ARP messages from being accepted.

4. MAC Flooding Attack

A switch’s MAC address table (the CAM table) has a limited capacity. In a MAC flooding attack, an attacker sends a large number of frames with many different, often fake, source MAC addresses, aiming to fill this table completely. Once the table is full, many switches fall back into what is called “fail-open mode”: instead of forwarding frames only out the port associated with the destination MAC, the switch starts flooding incoming traffic out every port, behaving essentially like a hub. This lets the attacker see traffic that was never meant to reach them.

Mitigation strategies:

Configure port security to limit the number of MAC addresses allowed to be learned on a given port, so a single attacker port cannot flood the CAM table.
Implement 802.1X authentication, which verifies a user’s credentials before granting network access and can apply different access levels depending on who authenticates.