For Layer 2 connections and designs, interconnected switches are often linked via a trunk. A trunk link can be either manually configured on both sides of a link, or automatically negotiated using the Dynamic Trunking Protocol (DTP).

An attacker might exploit the DTP and negotiate a trunk with the switch port. It is possible that the attacker will attempt to leverage a PC or server to present itself as a switch to the connected switch.

Adverse Effects

• If the attacker is able to negotiate DTP, the attacker could gain access to any VLAN, perhaps secured VLANs for critical data transfers.

Steps to Mitigate

• Manually configure access ports
• Shut down unused interfaces
• Restrict VLANs on trunk ports

References

• What is Switch spoofing attack and how to prevent Switch spoofing attack
• Understanding, Preventing, and Defending Against Layer 2 Attacks