- 7 partsfree videos in Malayalam
- Layer 2switches, MAC addresses, VLANs
- 6 attacksand how each works
- Defencesfor every one
When people think of hacking, they picture attacks over the internet. But some of the most effective attacks happen inside a network, from a laptop plugged into the same office switch or connected to the same Wi-Fi. These are layer 2 attacks, and they target the switches that every device depends on. Understanding them is essential for network engineers, SOC analysts and anyone preparing for CEH. Practise them only in your own lab.
The series, part by part
- Part 1
Sniffing basics: hubs vs switches
Sniffing means capturing traffic on a network. A hub sends every packet to every device, so anyone connected can read everything. A switch sends each packet only to the port it's meant for, which is why attackers try to trick switches into behaving like hubs.
- Part 2
CAM table attacks
A switch remembers which MAC address is on which port in its CAM table. In a MAC flooding attack, the attacker sends thousands of fake MAC addresses until the table is full; many switches then flood traffic out of every port, like a hub, and the attacker can sniff it. Defence: port security that limits how many MAC addresses each port may learn.
- Part 3
DHCP attacks
DHCP hands out IP addresses. In DHCP starvation, an attacker requests every available address so real devices get none. With a rogue DHCP server, the attacker answers requests first and makes themselves the gateway, so traffic flows through them. Defence: DHCP snooping, which only trusts DHCP replies from known ports.
- Part 4
ARP, IRDP and MAC attacks
ARP links IP addresses to MAC addresses, and it trusts any reply. In ARP poisoning (spoofing), the attacker announces "I am the gateway", so victims send their traffic to the attacker: a classic man-in-the-middle. IRDP spoofing similarly fakes router announcements, and MAC spoofing copies another device's MAC address. Defence: Dynamic ARP Inspection, together with DHCP snooping.
- Part 5
VLANs, the default VLAN and VLAN tags
VLANs split one physical switch into separate logical networks, such as staff, guests and servers. Frames carry a VLAN tag (802.1Q) so switches know which VLAN they belong to. Leaving ports on the default VLAN 1 is a common weakness. Defence: move user ports off VLAN 1 and put unused ports in a dead VLAN.
- Part 6
Native VLAN and trunk ports
Trunk ports carry traffic for many VLANs between switches. Traffic on the native VLAN travels untagged, which is exactly what VLAN hopping attacks abuse. Defence: use an unused VLAN as the native VLAN and tag it explicitly.
- Part 7
Switch spoofing and double tagging
Both are VLAN hopping attacks: ways to reach a VLAN you shouldn't. In switch spoofing, the attacker pretends to be a switch so their port becomes a trunk carrying every VLAN. In double tagging, the attacker adds two VLAN tags so the first switch strips one and the next forwards the frame into the target VLAN. Defence: disable automatic trunk negotiation (DTP) on user ports and secure the native VLAN.
The defences at a glance
| Attack | Main defence |
|---|---|
| MAC flooding (CAM table) | Port security: limit MAC addresses per port |
| DHCP starvation and rogue DHCP | DHCP snooping with trusted ports |
| ARP poisoning | Dynamic ARP Inspection |
| Default VLAN weaknesses | Move ports off VLAN 1; shut unused ports |
| Switch spoofing | Disable DTP; set user ports to access mode |
| Double tagging | Use an unused, tagged native VLAN |
Want to see these attacks in a lab and capture them yourself? Learn the networking foundations first with real Wireshark captures: see how to become an ethical hacker in Kerala, or start our 50 Days Ethical Hacking Challenge. These topics are also part of the CEH sniffing module.
Free, in Malayalam
Watch the full 7-part series
Every attack above, explained step by step in Malayalam on our Safeonnet YouTube channel. Then take it further with our courses.
Keep reading
Frequently asked questions
What is a layer 2 attack?
An attack on the data link layer, where switches forward traffic using MAC addresses and VLANs. Examples include MAC flooding, DHCP attacks, ARP poisoning and VLAN hopping.
What is MAC flooding?
Sending thousands of fake MAC addresses to fill a switch's CAM table, so the switch floods traffic to every port and the attacker can sniff it. Port security prevents it.
How does ARP poisoning work?
ARP trusts any reply, so the attacker announces their own MAC address for the gateway's IP. Victims then send traffic through the attacker. Dynamic ARP Inspection blocks it.
What is VLAN hopping?
Reaching a VLAN you shouldn't have access to, through switch spoofing or double tagging. Disabling DTP on user ports and securing the native VLAN prevent it.
Are these videos in Malayalam?
Yes. All seven parts are free on our Safeonnet by Edwhere Learning YouTube channel, explained in Malayalam.