This thesis investigates Layer 2 (Data Link layer) infrastructure attacks, focusing on MAC flooding and spoofing, VLAN hopping, STP manipulation, and management-plane exploitation in modern Ethernet networks. The research will analyze how these attacks compromise network availability, confidentiality, and integrity by overwhelming switch tables, bypassing VLAN isolation, manipulating spanning tree configurations, or exploiting insecure management interfaces. Controlled lab environments simulating enterprise networks will be used to demonstrate attack techniques and understand their impact on network operations, including traffic disruption, unauthorized access, and lateral movement potential within the internal network.
The thesis will further evaluate detection and mitigation strategies specific to these Layer 2 threats, including port security, dynamic MAC address limiting, VLAN configuration best practices, STP hardening, and management-plane access control. Effectiveness will be quantified by measuring attack detection rates, false positive drivers, and resilience to evasion attempts. Expected contributions include a detailed taxonomy of Layer 2 attacks within the selected scope, lab-based demonstrations of each technique, and a comparative analysis of defensive measures, providing actionable guidance for network administrators and security teams to secure Layer 2 infrastructure while maintaining operational efficiency.