Layer 2 attacks and defences: MAC flooding, VLAN hopping, spoofing and storm control
In short: Switches trust whatever a connected device tells them, so an attacker on one access port can flood the MAC table, jump VLANs or pretend to be the gateway. Port security, disabling DTP, DHCP snooping, Dynamic ARP Inspection, IP Source Guard, BPDU Guard and storm control close these gaps.
Why Layer 2 needs its own defences
Firewalls usually sit at the edge of the network, but most devices meet the network at an access switch. Ethernet, ARP (Address Resolution Protocol), DHCP (Dynamic Host Configuration Protocol) and spanning tree were designed for friendly environments. They accept what devices announce without checking it. Anyone who can plug into a wall port or join a wired VLAN can therefore abuse them, and the firewall never sees the traffic because it stays inside the VLAN.
The good news is that modern switches include a feature for almost every Layer 2 trick. You configure them once on access ports and trunks, ideally as part of a standard template.
The main attacks in plain terms
| Threat | What goes wrong | Defence |
|---|---|---|
| MAC flooding | A device sends frames from thousands of fake MAC addresses. The switch table fills up and the switch floods traffic to every port, so others can read it. | Port security limits how many MAC addresses a port may learn. |
| VLAN hopping (switch spoofing) | A device pretends to be a switch and negotiates a trunk using DTP (Dynamic Trunking Protocol), gaining access to every VLAN. | Set access ports to switchport mode access and turn off DTP with switchport nonegotiate. |
| VLAN hopping (double tagging) | A frame carries two 802.1Q tags. The first switch strips the outer tag on the native VLAN and forwards the inner one into another VLAN. | Use an unused VLAN as the native VLAN on trunks, never put users in it, and tag the native VLAN where supported. |
| Rogue DHCP and starvation | A fake DHCP server hands out itself as the gateway, or a device grabs every free address. | DHCP snooping with trusted uplinks and a rate limit on access ports. |
| ARP spoofing | A device answers ARP requests for the gateway address, so traffic flows through it. | Dynamic ARP Inspection (DAI) checks ARP replies against the DHCP snooping table. |
| IP address spoofing | A device uses an IP address it was not given. | IP Source Guard only allows the address recorded by DHCP snooping. |
| Spanning tree manipulation | A device sends BPDUs (bridge protocol data units) claiming to be the best root bridge, changing the path of traffic. | BPDU Guard on edge ports, Root Guard on ports that should never lead to the root. |
| Broadcast storms | A loop or faulty device floods broadcasts and the VLAN slows to a crawl. | Storm control drops excess broadcast or multicast traffic. |
A secure access port template
The commands below show how the defences fit together on a Cisco IOS access switch. VLAN numbers and limits are examples; adjust them to your design and test in a lab first.
ip dhcp snooping
ip dhcp snooping vlan 10,20
ip arp inspection vlan 10,20
!
interface range GigabitEthernet1/0/1 - 46
switchport mode access
switchport nonegotiate
switchport port-security
switchport port-security maximum 2
spanning-tree portfast
spanning-tree bpduguard enable
storm-control broadcast level 5.00
ip dhcp snooping limit rate 15
ip verify source
!
interface GigabitEthernet1/0/48
description Uplink to distribution
switchport mode trunk
switchport nonegotiate
switchport trunk native vlan 999
ip dhcp snooping trust
ip arp inspection trustTip: DAI and IP Source Guard depend on the DHCP snooping binding table. Devices with static addresses, such as printers, need static bindings or ARP ACLs, or they will be blocked.
Real-world example: a rogue router in a classroom
A secondary school found that pupils in one classroom were getting addresses from the wrong range and could not reach the internet. A pupil had plugged a home Wi-Fi router into a spare wall port, and its built-in DHCP server was answering faster than the real one. The network team enabled DHCP snooping with only the uplinks trusted, added port security with a two-address limit and applied BPDU Guard on every classroom port. The next time someone connected a router, the port shut down, an alert reached the helpdesk and other pupils were not affected.
Operating these features safely
- Roll out in stages: enable features on one switch, watch the logs, then extend.
- Configure
errdisable recoverycarefully, or decide that a person must re-enable shut ports after checking them. - Shut down unused ports and put them in an unused VLAN.
- Combine these features with 802.1X so that only known devices are allowed on the port at all.
For the basic switch and router controls, see Securing switches and routers and the switch hardening playbook.
Practice
Which feature stops a device from negotiating a trunk on an access port?
Why does Dynamic ARP Inspection need DHCP snooping?
A pupil connects a small switch that sends BPDUs into a classroom port. What should happen?
Key takeaways
- Layer 2 protocols trust devices by default, so access ports need protection.
- Port security limits MAC addresses; disabling DTP and using an unused native VLAN stop VLAN hopping.
- DHCP snooping, DAI and IP Source Guard work together against rogue DHCP and spoofing.
- BPDU Guard, Root Guard and storm control protect the spanning tree and stop storms.
- Roll features out in stages and combine them with 802.1X.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.