How Can VLAN Hopping Attacks Be Prevented On A Network?

• On each nontrunk port, it can disable the STP.
• On the link of trunks, it uses the ISL encapsulation.
• On the trunks port, it can use the VLAN 1 as the local VLAN.
• It can incapacitate the negotiation of the trunk for the trunk ports and technically set the nontrunk ports as an access port. 

Answer: The attack of VLAN hopping depends on the hacker who is able to form the trunk link along with the switch. The attacks can be prevented with incapacitated DTP and user-facing ports configuration as the static access ports which are helpful. The incapacitation of STP (Spanning tree protocol) can’t erase the attacks as VLAN hopping.

What is VLAN hopping?

Virtual local area network hopping or VLAN hopping is the process of attacks on the resource of the VLAN by forwarding the frames to the port which are not accessible through an end system. The major purpose of the attack is to get access to other VLANs on the same network.

For the process to begin the treat actor has to violate at least one of the VLAN on the given network, which will help the cybercriminals to form the base for the attack on other VLANs which are connected to the same network with the breach.

 How does VLAN hopping cause vulnerability in the security of the network? 

The weakness in the VLANs is associated with certain features such as:

• Make the network administrator divide at least one of the switched networks to compare the requirements as functional and security of the system without the need of a new wire or modify the infrastructure.
• Make the performance of the network better by joining the device which communicate often together.
• Give the larger network better and improved security by allowing control to the devices such as which one has access or not.

Splitting the user’s VLANs help in the security improvement because the users are able to access the network which they are requested. And if the one VLAN is attacked by the hacker they will retain it in that network.

Prevention of VLAN hopping:

• Better security can prevent the VLAN hopping such as the interface which is untouched should be placed and closed in a VLAN.
• Try to avoid the VLAN trunk port use if it is not urgent.
• Extra access ports need to be configured by hand with the help of switch port mode access.
• The switch spoofing and double tabbing can be avoided with the help of proper switch configuration.
• To minimize the switch spoofing risk, try to switch off the auto-tracking feature on the switches which are in no need to trunk.
• The extra port that should not be trunks must be set as the access ports.
• The double tagging is prevented through three steps such as:

1. The host must not be on the default Ethernet VLAN or VLAN 1.
2. The local VLAN on each trunk port should be an unused VLAN ID.
3. For all trunk ports, the direct tagging of local VLAN must be allowed.

Which of the following best describes the concept of a VLAN?

1. It is the device on different networks on which various packets are received.
2. The devices are present on the same network but logically linked the way they were working on the separate network.
3. These are the devices that without the use of network addresses can communicate through the help of the internet.

Answer: The correct answer is option 2 which describes that VLAN is the devices present on the same network but logically linked the way they were working on the separate network.

VLAN concept describes that in this process the device is divided logically on the data link layer of the OSI model. The devices on the network layer divide the broadcast domain with the help of the concept of VLAN. The broadcast is the process in which one device is designated for the packet all of the devices connected will also receive the packets. This receival of the packets is limited to only switches and the router might not be able to send the packets, for that we need the inter VLAN routing. With the help of the VLAN, various small-sub-networks which are different from each other are formed which are quite easy to handle.

For the connection with VLAN, there are possible three ways and the connection depends on the devices which are connected such as they are either VLAN-aware (VLAN-aware must know about the formats) or VLAN unaware (these are not aware of the formats and memberships). The VLAN connections are discussed in the following:

Trunk link

The devices along with the connection with the trunk link are VLAN-aware. The packets on this connection must have the attached header known as the tagged frames.

Access link

The purpose of this link is to establish the link among VLAN-unaware devices with its bridges. Unlike the trunk link, the frames on it have to be untagged.

Hybrid link

It is the link that combines both the trunk and access link properties. in this, both VLAN-unaware and aware devices are connected and have both frames tagged and untagged.

Ranges:

The ranges of the VLAN are listed below with some works:

• VLAN 0,4095: these are the taken VLAN ranges that can’t be seen and used.
• VLAN 1: it is the default range for the switches, all ports of the switches present in VLAN.it can’t be removed or modified but can be used.
• VLAN 2-1001: it is the general range that can be changed formed, modified, and deleted.
• VLAN 1002-1005: it is the range for the CISCO default and token ring, and they can’t be deleted.
• VLAN 1006-4094: it is considered as the extended range.

Some of the benefits of the VLAN are listed below:

• Performance is improved with the help of it.
• It helps in the formation of virtual groups which helps the data retrieval.
• It is easy to access the control for firewalls, domain without the worry of security.
• It gives flexibility in the creation, modification, etc.
• It helps to reduce the cost by developing the broadcast domains.

Which of the following statements is true regarding using multiple VLANs on a single switch? 

1. The Broadcast domain increases.
2. The collision domain remains the same.
3. The broadcast domain remains the same.
4. The collision domain must decrease.
5. The collision domains increase in number.
6. The broadcast domain number must increase.

Answer: The correct answer is options (2) and (6) .by using the multiple VLAN on a single switch it can make the collision domain remain the same and the broadcast domain number must increase.

Let’s take a look at how the multiple VLAN on the single switch is used? As the VLAN uses multiple switches more than one VLAN also uses the single switch. The multiple VLAN in the various switches establish the communication through a single link through the switches. for this, the process trunking is used which permits multiple VLAN communication through the single link between the switches.

What is trunking?

Trunking is the method that is essential for the data communication system that gives multiple users access to the network with the process of sharing the various lines and frequencies.it is indicated in the name that the technology is a tree-like infrastructure with one trunk and multiple branches. The common use of trunking is in the VHF (very-high-frequency) and the telecommunication system.

The trunking process is also defined as a network that is capable to manage various signals at the same time. The data which moves through the technology is either audio, video, signals, or images. The network as telecommunication through the world uses the trunking process.it can minimize the size of this network and also increase the bandwidth. Very-high-frequency radio in the police and control center is also due to trunking.

Moreover, trunking is the key element of the VLANs. The VLAN is the process in which a physically existed network can create the independent virtual logical network broadcast domains. The important link for the communication is the trunk, the switches established a connection with the link and can provide support to various clients by establishing the branches.

In the share hubs, the VLAN is the improvement of it, VLAN can form the groups of client devices which can easily communicate with each other. On the network which has high traffic, it can be able to reduce the traffic congestion.it can also make the segments for the data that move through the switches. The link can transfer many data packets from the VLANs. the switches are connected through a trunk link to make the ports independently configured with a dedicated VLAN.

The VLAN trunking can extend the VLAN through the network. when the various VLANs across the network are implemented, the links are in need to make sure that the signals are segregated to reach the designation.it is considered as efficient as multiple VLAN configured on a single port. Multiple VLAN on the single port helps in differentiation and signals routing. The trunking port of VLAN uses the identifying tags so that the frames are marked as they move between the switches. 

Which type of port transfers data using light waves?

Answer: IrDA is the port that transfers data using the light waves.it is described as a standard through which the data is transmitted with the help of an infrared port. The speed is almost the same as the normal parallel ports. Those who developed the port use wireless technology for two-device connectivity.

What is IrDA port?

IrDA stands for the infrared Data Association which used infrared light beams for the information transmission and also needs a direct line of sight and the range for its proper working is less. For the protocol set which is complete IrDA gives the specification for the wireless communication. The port sports Bluetooth which is a benefit for the long-distance mostly around 30 feet and also the Omni-directional.

The main purpose for using the IrDA is its specification of the wireless data transfer with the principles of point-to-shoot within the range of the last one meter. The port is used in many things as the TV, DVD players use the controls of IR .few mobile phones are also able to use the IR port to manage the electronic devices but it can also use the additional software.it can guarantee the transfer of data, the line-of-sight, and the error range is low which is the reason for its efficiency.

The communication is cheaper and quite adopted for the shorter ranges as 1-3m through wireless. Mostly the technology is used in the electronic consumer, automobiles, OC medical devices, home appliances, and any kind of commercial services. The IrDA protocol stack is the model of the open system interconnection and a few of its specifications are discussed in the following:

IrPHY (Infrared physical layer)

The ability is specified to assist point-to-point communication among the electronic devices. It gives the facility of optical media interface for SIR (serial infrared) transmission and it is the part of the first layer of the OSI model.

Infrared link access protocol (IrLAP)

It is the facility of the second layer of the OSI model of IrDA.it is present between the IrPHY and IrLMP layers.it shows the data link layer.

Infrared link management protocol (IrLMP)

This is the third layer of the IrDA abilities.it can describe the link management multiplexer and also the link management information access service.

Transport protocol (TinyTP) 

This non-obligatory protocol targeted inside the fourth layer lies on the pinnacle of the IrLMP layer.

 Infrared communication protocol (IrCOMM)

The IrCOMM protocol targeted inside the 5th layer shall we the infrared tool act like both a serial or parallel port.

 Infrared Financial Messaging (IrFM) 

This protocol targeted with inside the 6th layer is a Wi-Fi charge widespread evolved via

way of means of the Infrared Data Association.

What is the minimum Ethernet frame size?

• 1500 bytes.
• 64 bytes.
• 32 bytes.
• 1024 bytes.

Answer: The minimum Ethernet frame size is 64 bits, any frames which are smaller than the minimum size are described as the collision part or runt frames that need to be removed.

The Ethernet frames are described by the IEEE standard, it starts with the preamble and the SFD which work on the physical layer. The header of the Ethernet has the source and the destination MAC address. the end field is the CRC that can find the errors. Let’s discuss the Ethernet frames in the following:

The general terms for describing the frames are their size and the MTU (maximum transmission unit) size. The total frame of the Ethernet is the sum of the total Ethernet header (14 bytes). payload filed of Ethernet (the IP frames .1500 bytes), and the last field check sequence field (4 bytes).

The purpose of the Maximum size units is to define the highest number of the bytes of data that are enclosed in the frames of the Ethernet, such as the default MTU size of the Ethernet frames is 1500 bytes. Moreover, the highest frame size of the MTU is 9000 and it is also configured.

Advantages of increasing the Gigabit Ethernet frame size

The pros of the increment in the default size for Gigabit Ethernet will assist the storage system and the infrastructure of the Gigabit Ethernet frame. The performance is also increased significantly depending on the work.

Pros of the Jumbo frames

The jumbo size might be used to lessen the processing of the CPU with the network interface, as the jumbo is greater in size than the normal frames.

Flow control

Flow control is the maintenance of the frame flow among the directly connected link partners. with the help of the flow control, the packet’s movement can be paused and then start from the point when it is needed.

The minimum size of the frames are 64 bytes while the maximum is 1518 bytes .and it consists of all the field included in the frames except the preamble and the start frame delimiter. The size of frames less than 64 is the collision fragment and discarded from the destination station. The size of the frames increased for the VLAN tags. If there is any change in the size of frames the designated device will drop the packets, which are the reason for the collision or the unwanted signals which considered as invalid the frames are almost the same at the data link layer, while at the physical layer different version are present and their methods vary for detection and the placement of the data in media.

The formula for the maximum number of frames per second is:

Ethernet Data Rate (bits per second) / Total Frame Physical Size (bits)

Suppose we have the data rate of 10 000 0000 and the total frame size is 84 then:

= 10 000 0000 / (84 x 8)

= 14 880 frames per second.