How do you verify the DTP (Dynamic Trunking Protocol) mode on a switch interface?

Use the show dtp interface <interface-id> command to see the current DTP negotiation status, mode, and neighbor information.

Example output from show dtp interface fa0/1:

Key fields:

• TOS/TAS/TNS: ACCESS/AUTO/ACCESS — shows the operational/administrative/negotiated states
• TOT/TAT/TNT: NATIVE/NEGOTIATE/NATIVE — trunk operating/administrative/negotiated type
• Neighbor address — MAC (Media Access Control) address of the DTP neighbor
• Hello timer expiration — DTP sends hellos every 30 seconds
• FSM state: S2:ACCESS — the final negotiated result (Finite State Machine)

Best practice recommendations:

1. Explicitly set all ports to access or trunk — don't rely on DTP auto-negotiation
2. Use switchport nonegotiate on trunk ports to stop sending DTP frames
3. Set unused ports to access mode and shut them down

Why disable DTP? An attacker with physical access could connect a device that sends DTP frames, trick a dynamic port into becoming a trunk, and then receive traffic from all VLANs (Virtual Local Area Networks) on the switch. This is called a VLAN hopping attack via DTP manipulation.

Go deeper:

• VLAN hopping — switch spoofing (Wikipedia) — the dynamic-port abuse the verification/hardening steps defend against.