--- title: Hiding Malicious Packets Behind LLC SNAP Header «... description: Vulnerability Note VU#855201 documents four vulnerabilities where a malformed combination of LLC SNAP and VLAN headers — specifically sending WiFi-formatted... canonical: https://daily.dev/posts/hiding-malicious-packets-behind-llc-snap-header-ipspace-net-blog-z3w6svc4h twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Hiding Malicious Packets Behind LLC SNAP Header « ipSpace.net blog | daily.dev og:description: Vulnerability Note VU#855201 documents four vulnerabilities where a malformed combination of LLC SNAP and VLAN headers — specifically sending WiFi-formatted... og:url: https://daily.dev/posts/hiding-malicious-packets-behind-llc-snap-header-ipspace-net-blog-z3w6svc4h og:image: https://api.daily.dev/og/posts/Z3W6sVC4h.png og:image:alt: Hiding Malicious Packets Behind LLC SNAP Header « ipSpace.net blog og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hiding Malicious Packets Behind LLC SNAP Header « ipSpace.net blog **[ipSpace.net Blog](https://daily.dev/sources/ipspace)** · 4 min read · 0 upvotes · 0 comments ## Summary Vulnerability Note VU#855201 documents four vulnerabilities where a malformed combination of LLC SNAP and VLAN headers — specifically sending WiFi-formatted (LLC-encapsulated) packets over Ethernet — can bypass layer-2 security mechanisms on most network devices. Most operating systems process these unusual header stacks normally, while hardware forwarding ASICs fail to parse them, allowing packets to slip past layer-3 ACLs on layer-2 ports, ARP/ND inspection, DHCP guard, and RA guard. The exploit does not enable VLAN hopping. Arista's advisory recommends dropping frames where the hardware parser stops at 802.1q/802.1ad EtherType, or using a strict ACL permitting only IPv4, IPv6, and ARP traffic. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE/VU#855201 and how does the LLC SNAP header vulnerability work to bypass layer-2 security? VU#855201 documents four vulnerabilities where sending WiFi-formatted LLC SNAP-encapsulated packets over Ethernet confuses hardware forwarding ASICs. Most operating systems accept and process the unusual header stack normally, but switch hardware fails to parse the inner payload, allowing packets to bypass layer-2 security controls including layer-3 ACLs on layer-2 ports, ARP/ND inspection, DHCP guard, and RA guard. It does not enable VLAN hopping. _Network engineers hardening switching infrastructure track advisories like VU#855201 on daily.dev._ ### What is Arista's recommended mitigation for the LLC SNAP VLAN header bypass vulnerability? Arista recommends two mitigations: first, a layer-2 ACL that drops any frames where the hardware parser stopped at 802.1q or 802.1ad EtherType; second, a stricter ACL that permits only IPv4, IPv6, and ARP frames. The stricter ACL also addresses a separate related vulnerability and is the preferred approach. _Security teams evaluating switch vendor advisories for this class of vulnerability find relevant coverage on daily.dev._ ## Similar posts on daily.dev - [When Wi-Fi Encryption Fails: Protecting Your Enterprise from AirSnitch Attacks](https://daily.dev/posts/when-wi-fi-encryption-fails-protecting-your-enterprise-from-airsnitch-attacks-kjapwpgqj) · Unit 42 · 0 upvotes · 0 comments - [Unpatchable? How Chinese Hackers Hid in Dell VMs for 2 Years Using "Magic Packets"](https://daily.dev/posts/unpatchable-how-chinese-hackers-hid-in-dell-vms-for-2-years-using-magic-packets--fzvlv90ci) · InfoSec Write-ups · 29 upvotes · 0 comments - [Thinking Outside The Box \[dusted off draft from 2017\]](https://daily.dev/posts/thinking-outside-the-box-dusted-off-draft-from-2017--otcsxybbm) · Project Zero · 1 upvotes · 0 comments - [NatJack exploits put NAT security assumptions to the test at Black Hat](https://daily.dev/posts/natjack-exploits-put-nat-security-assumptions-to-the-test-at-black-hat-ksuuijyjx) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/hiding-malicious-packets-behind-llc-snap-header-ipspace-net-blog-z3w6svc4h) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Hiding Malicious Packets Behind LLC SNAP Header « ipSpace.net blog","url":"https://daily.dev/posts/hiding-malicious-packets-behind-llc-snap-header-ipspace-net-blog-z3w6svc4h","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hiding-malicious-packets-behind-llc-snap-header-ipspace-net-blog-z3w6svc4h"},"datePublished":"2026-08-11T08:56:07.548Z","dateModified":"2026-08-11T09:33:59.519Z","description":"Vulnerability Note VU#855201 documents four vulnerabilities where a malformed combination of LLC SNAP and VLAN headers — specifically sending WiFi-formatted...","image":"https://media.daily.dev/image/upload/s--0_ODbtD2--/f_auto/v1722860399/public/Placeholder%2008","thumbnailUrl":"https://media.daily.dev/image/upload/s--0_ODbtD2--/f_auto/v1722860399/public/Placeholder%2008","isAccessibleForFree":true,"articleSection":"ipSpace.net Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ipSpace.net Blog","logo":"https://media.daily.dev/image/upload/s--xS7E82MT--/f_auto,q_auto/v1786438303/logos/ipspace?_a=BAMAMicg0","url":"https://daily.dev/sources/ipspace"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hiding-malicious-packets-behind-llc-snap-header-ipspace-net-blog-z3w6svc4h","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ipSpace.net Blog","item":"https://daily.dev/sources/ipspace"},{"@type":"ListItem","position":3,"name":"Hiding Malicious Packets Behind LLC SNAP Header « ipSpace.net blog"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/hiding-malicious-packets-behind-llc-snap-header-ipspace-net-blog-z3w6svc4h#faq","mainEntity":[{"@type":"Question","name":"What is CVE/VU#855201 and how does the LLC SNAP header vulnerability work to bypass layer-2 security?","acceptedAnswer":{"@type":"Answer","text":"VU#855201 documents four vulnerabilities where sending WiFi-formatted LLC SNAP-encapsulated packets over Ethernet confuses hardware forwarding ASICs. Most operating systems accept and process the unusual header stack normally, but switch hardware fails to parse the inner payload, allowing packets to bypass layer-2 security controls including layer-3 ACLs on layer-2 ports, ARP/ND inspection, DHCP guard, and RA guard. It does not enable VLAN hopping. Network engineers hardening switching infrastructure track advisories like VU#855201 on daily.dev."}},{"@type":"Question","name":"What is Arista's recommended mitigation for the LLC SNAP VLAN header bypass vulnerability?","acceptedAnswer":{"@type":"Answer","text":"Arista recommends two mitigations: first, a layer-2 ACL that drops any frames where the hardware parser stopped at 802.1q or 802.1ad EtherType; second, a stricter ACL that permits only IPv4, IPv6, and ARP frames. The stricter ACL also addresses a separate related vulnerability and is the preferred approach. Security teams evaluating switch vendor advisories for this class of vulnerability find relevant coverage on daily.dev."}}]} ```