Understanding how attacks work conceptually lets you recognize and block them. This lesson explains three families of network attack and the defenses for each. No attack steps are given; the focus is detection and prevention.

Man-in-the-middle (MITM)

In a MITM attack, an adversary secretly positions themselves between two parties and can read or alter their traffic. Common enablers include rogue Wi-Fi hotspots (“evil twin” networks), ARP spoofing on a local network, DNS tampering, and fake or stolen certificates.

Defenses:

  • Use HTTPS/TLS everywhere and heed browser certificate warnings.
  • Use a trusted VPN on untrusted Wi-Fi.
  • Enable dynamic ARP inspection and port security on managed switches.
  • Use DNSSEC or encrypted DNS where possible.
  • Verify Wi-Fi network names and prefer WPA3.

Denial of service (DoS and DDoS)

A DoS attack aims at availability by exhausting a resource: bandwidth, connection tables or application capacity. A distributed DoS uses thousands of compromised devices (a botnet). Types include volumetric floods, protocol attacks such as SYN floods, and application-layer floods of legitimate-looking requests. Amplification attacks abuse open servers that return much larger replies than the request.

Defenses:

  • Rate limiting and connection limits.
  • SYN cookies on servers.
  • Content delivery networks and DDoS scrubbing services.
  • Redundancy and autoscaling.
  • Blocking spoofed source addresses at the network edge (ingress filtering).
  • Keeping your own devices patched so they do not join a botnet.

Spoofing

Spoofing means faking an identity. Variants:

  • IP spoofing: forged source addresses, often used in floods.
  • MAC spoofing: copying a device hardware address.
  • DNS spoofing/cache poisoning: returning false name answers.
  • Email spoofing: forged sender addresses used in phishing.

Defenses: SPF, DKIM and DMARC for email; ingress and egress filtering; cryptographic authentication so identity does not rely on an address alone.

Detecting trouble

Signs include sudden traffic spikes, many half-open connections, duplicate IPs or changing MAC addresses for the gateway, and certificate errors. On your own practice machine you can inspect your ARP table:

arp -a

If the gateway’s MAC address suddenly changes, investigate.

Check your understanding

1. Which goal does a DoS attack primarily target?

  • Confidentiality
  • Integrity
  • Availability
  • Accountability

Answer: Availability. The aim is to make a service unusable.

2. What is the best everyday defense against MITM on public Wi-Fi?

  • Turning off the screen
  • Using HTTPS and a trusted VPN
  • Using a shorter password
  • Disabling updates

Answer: Using HTTPS and a trusted VPN. Encryption makes intercepted traffic unreadable and tamper-evident.

3. Which technologies help stop forged email senders?

  • SPF, DKIM, DMARC
  • FTP, Telnet, HTTP
  • ARP, ICMP, RIP
  • RAID, UPS, NAS

Answer: SPF, DKIM, DMARC. They let receivers verify a message came from an authorized sender.

4. What makes a DDoS different from a DoS?

  • It uses encryption
  • It comes from many distributed sources
  • It only affects email
  • It needs physical access

Answer: It comes from many distributed sources. This makes it harder to block by address.

PreviousNext