I am evaluating subneting our network with a Layer 2 switch and VLAN. From what I know, VLAN only works on broadcast domain, and if I know the MAC address of a remote computer on the same switch, I can bypass the VLAN security entirely by mapping the MAC address to my own ARP table. Is that correct?


  • 4
    No, and your question is just a tiny bit confusing, can you rewrite it please. – Chopper3 Mar 4 '10 at 17:43
  • I think you guys have answered it, but here is some clarification: My computer is, and I want to communicate with, which is on a different VLAN. If I know its MAC address in advance, can I add it to my ARP table to hop between VLAN? – jackbean Mar 4 '10 at 19:41
  • 1
    If your IP is then your packets to need to go via router ... it is different network and layer 3 needs to be involved. As the others already wrote, there is no such a way to hop between VLANS just by knowing the MAC address of the host in the other VLAN. Depending on the switch configuration, some vulnerabilities may exist - see the basic description en.wikipedia.org/wiki/VLAN_hopping – L.R. Mar 4 '10 at 20:04
  • Thanks. For some reason I always thought the VLAN tagging only applies to broadcast packets. – jackbean Mar 4 '10 at 20:53

You are not correct. When a switch creates a VLAN, it is effectively the same as if you created two separate networks connected with their own switches. A person can no more bypass the VLAN using a direct MAC address than you could gain access to your neighbor across the street if you knew his MAC address.
Think of it as two physically separated networks.

  • Can you clarify a little further. My understanding has been that VLAN tagging only affects broadcast packets. Cisco defines VLAN as "a broadcast domain within a switched network." It also mentions, "VLANs improves performance and security in the switched network by controlling broadcast propagation." According to: ciscopress.com/articles/article.asp?p=102157 Thanks – jackbean Mar 4 '10 at 22:54
  • VLAN tagging affects all packets that are tagged, regardless of whether they are broadcast or not. It improves performance because inherently a broadcast on VLAN 1 will not be passed to VLAN2 because the broadcast packet has been tagged with VLAN=1. This is an Ethernet (layer 2) property, so broadcast and unicast packets perform equally. Look at en.wikipedia.org/wiki/IEEE_802.1Q and notice that the VLAN is actually inserted into the EII frame. This applies for all packets, not just broadcast packets. – Scott Lundberg Mar 4 '10 at 23:18
  • Concerning Cisco's definition, it means a broadcast domain includes all devices that would receive the broadcast. I.e. any device on the same VLAN, but that doesn't mean VLANs only apply to broadcast packets. – Scott Lundberg Mar 4 '10 at 23:25

No, it isn't. This may have been possible in some of the earliest implementations of VLANs (20 years ago...) but on any modern switch, once a port is tagged with an 802.1q VLAN, that's it. The switching engine won't allow VLAN hopping. Of course, if you have an insecure configuration (say, a host with interfaces on more than one network, with IP forwarding enabled...) you could have some security issues.

I work at a rather large university (we have two Class B's, and still need most of a Class A for NATted clients). Our network is run on Cisco, Foundry, and Juniper hardware, and everything is VLANed. We've never had any issues with it, security or otherwise.


There are some techniques to bypass VLAN tagging, but they only apply for some switches and in some configurations. If you have Cisco switches that have VLAN 1 on a trunk, you can send packets to machines in another VLAN (but not get anything back) if you send a .1q-encapsulated frame with the target VLAN as the VLAN tag.


There are two techniques for vlan hopping. Take advantage of auto trunking by making the router think you are another router and then you have access to all vlans. Artificially create double tagged packets and take advantage of backward comparability to hop to the target vlan.


I can bypass the VLAN security entirely by mapping the MAC address to my own ARP table. Is that correct?

Generally, no, you will not be able to do this.

Updating your arp table means that packets sent to the remote computer would make it as far as the switch. However, the switch still won't do anything with them, since your port on the switch is still part of a different network. With the arp update, the packets wouldn't even leave your computer. The update means packets can make it a little further down the road, but still won't reach the destination.

If you want to create an exception to a vlan membership, the best way I've seen to do it is with a layer-3 switch (so really it's a router now) at the core of your network that also supports ACLs (access control lists) for routing security. You set up this switch with a route between the two vlan's, have the ACL set up with a default deny rule, and add your exceptions as allow rules in front of the deny rule.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.