A
trunk port carries multiple VLANs between switches using 802.1Q tagging. Native VLAN frames are untagged. Access ports carry only one VLAN and connect to end devices.
Trunk ports connect switches to switches (and switches to routers for inter-VLAN routing). VLAN double-tagging attack targets the native VLAN — change native VLAN from default (VLAN 1) to an unused VLAN. Only trunk ports you explicitly configure should be trunking — disable DTP on access ports.