How are VLAN hopping attacks mitigated?

Dynamic ARP Inspection (DAI) mitigates ARP spoofing and poisoning attacks, which is different from VLAN hopping.

VLAN hopping attacks often exploit Dynamic Trunking Protocol (DTP) to trick a switchport into becoming a trunk, allowing an attacker to send traffic across multiple VLANs. Manually configuring interfaces as either access ports or trunk ports (with specific allowed VLANs) and disabling DTP on all access ports prevents this vulnerability by removing the automatic trunk negotiation mechanism.

Activating all ports and placing them in the default VLAN increases the attack surface and can make VLAN hopping easier, as an attacker might leverage the default VLAN.

Configuring extended VLANs (VLAN IDs 1006-4094) relates to the range of available VLANs and does not, by itself, mitigate VLAN hopping attacks.