Depends on what they're using for NAC. If its something stupid like MAC addresses, I may try to fire something on the wire to check for someone elses MAC if possible, spoof that, it all depends. To fiddle around and tamper with NAC, it all depends on what I'm doing, what they're using for NAC and so forth. I have PacketFence lying around on a VM machine and have fiddled with it a but have never had to attack this head on... I look for workarounds all the time though Same applies for VLANs (VLAN hopping, trunkspotting (you read it here first from me )

Indeed.  Never heard the term before and Google only has one result for "trunkspotting vlan": this thread haha