Network Attacks

Most networking protocols were designed in an era when the internet was a small, trusted research network. The foundational assumptions — that routers won't lie, that DNS responses are honest, that ARP is reliable, that source IPs are authentic — were reasonable in 1981 but catastrophically wrong in 2026.

Network attacks exploit the gap between protocol design assumptions and deployment reality. Understanding these attacks is not about learning to cause harm — it is about understanding why security controls work, where they fail, and how to build systems that survive hostile environments.

Port Scanning

Port scanning determines which TCP/UDP ports are open on a host. Each open port reveals a running service — each service has a version, each version has known vulnerabilities. Nmap is the canonical tool:

# TCP SYN scan (half-open, stealthy — no full connection)
nmap -sS -p 1-65535 192.168.1.0/24

# Version detection (-sV) + OS fingerprinting (-O)
nmap -sV -O 192.168.1.1

# Aggressive scan (all detection, scripts, traceroute)
nmap -A 192.168.1.1

# UDP scan (slower, requires root)
nmap -sU -p 53,123,161,500 192.168.1.1

# Timing: -T0 (paranoid, slow) to -T5 (insane, noisy)
nmap -T2 -sS 10.0.0.0/24   # quieter scan

# Detect scan with IDS: Suricata rule
# alert tcp any any -> $HOME_NET any (msg:"Port Scan detected"; flags:S; threshold: type both, track by_src, count 10, seconds 60; sid:1001)

Network Enumeration

Beyond port scanning, attackers enumerate:

— DNS enumeration: zone transfers, brute-force subdomain discovery, reverse DNS for IP ranges. Tools: dig axfr, dnsenum, Subfinder.

— SNMP enumeration: if SNMP community strings are guessable, the entire device configuration is exposed.

— Banner grabbing: connecting to services and reading their version banners. SSH, HTTP headers, FTP 220 banners all reveal software versions.

— OSINT: Shodan/Censys for internet-exposed services, Whois for domain registration, BGP routing tables for IP ownership.

Defense Against Reconnaissance

Reduce information leakage: suppress banner messages (no SSH version in banner, no Server: header in HTTP, no SMTP banner revealing MTA version). Block SNMP from internet. Disable DNS zone transfers. Deploy honeypot ports — any connection to a non-running service triggers an alert.

ARP Spoofing in Detail

ARP (Address Resolution Protocol) maps IP addresses to MAC addresses within a broadcast domain. The protocol has no authentication — any host can claim any IP-to-MAC mapping. An attacker exploits this by sending unsolicited (gratuitous) ARP replies:

# Gratuitous ARP: "I am 192.168.1.1, MAC is AA:BB:CC:DD:EE:FF"
# Sent to broadcast — all hosts update their ARP caches

# Attacker runs:
arpspoof -i eth0 -t 192.168.1.50 192.168.1.1  # tell victim: gateway MAC = attacker
arpspoof -i eth0 -t 192.168.1.1 192.168.1.50  # tell gateway: victim MAC = attacker

# Enable forwarding so traffic actually reaches destination
sysctl -w net.ipv4.ip_forward=1

# Now run:
wireshark -i eth0   # capture all traffic between victim and gateway

MAC Flooding

A switch's CAM (Content Addressable Memory) table maps MAC addresses to switch ports. If an attacker floods the switch with frames from thousands of fake MAC addresses, the CAM table fills up. The switch falls back to flooding all frames to all ports — effectively becoming a hub. The attacker receives all traffic on the segment.

Defense: Port Security — limit the number of MAC addresses allowed per port. When exceeded, the port can shut down (err-disable) or drop the offending frames.

VLAN Hopping

VLAN hopping exploits trunk ports. An attacker sends double-tagged 802.1Q frames: an outer tag for the attacker's VLAN, an inner tag for the target VLAN. The first switch removes the outer tag and forwards on the trunk. The second switch sees the inner tag and delivers to the target VLAN. Defense: never use the native VLAN (VLAN 1) for user traffic; set a dedicated unused VLAN as the native VLAN on all trunks.

STP Attacks

Spanning Tree Protocol (STP) prevents Layer 2 loops by electing a root bridge and blocking redundant paths. An attacker can send STP BPDUs (Bridge Protocol Data Units) claiming to be the root bridge with the best priority. If the switch accepts it, the STP topology changes — potentially redirecting all traffic through the attacker's port. Defense: BPDU Guard on access ports (drops any received BPDU; error-disables the port).

IP Source Address Spoofing

IP packets carry a source address field that can be set to any value. There is no verification by default. Attackers use spoofed source IPs for:

— Amplification attacks: sending requests with victim's IP as source; servers send large responses to victim.

— ACL bypass: spoofing a trusted IP to pass firewall rules that allow traffic from that address.

— TCP blind injection: if an attacker can predict TCP sequence numbers, they can inject packets into a TCP session without being on-path.

BCP 38 (Network Ingress Filtering): ISPs should filter packets leaving their network with source IPs that don't belong to their customers. This prevents spoofing of external IPs from inside the network. ISPs that implement BCP 38 significantly reduce amplification attacks from their networks.

ICMP Redirect Attack

ICMP Redirect messages tell a host to use a different gateway for a specific destination. Legitimate use: routers telling hosts about a better route on the local segment. Attacker use: send forged ICMP Redirects to a host, redirecting all traffic through the attacker's IP. Defense: disable ICMP Redirect acceptance (Linux: net.ipv4.conf.all.accept_redirects=0).

BGP Route Hijacking

BGP (Border Gateway Protocol) is the internet's routing protocol. It operates on trust — each AS announces the prefixes it is authoritative for, and neighboring ASes propagate these announcements. There is no cryptographic verification of whether an AS legitimately owns the prefix it announces.

Attack: an AS announces a more-specific prefix (/24 versus the legitimate owner's /16). Internet routers prefer more-specific routes (longest prefix match), so traffic is redirected to the hijacking AS.

RPKI (Resource Public Key Infrastructure): Regional Internet Registries (ARIN, RIPE, etc.) sign Route Origin Authorizations (ROAs) — cryptographic statements that "AS 65001 is authorized to originate prefix 203.0.113.0/24." Routers with RPKI validation reject route announcements that conflict with ROAs. RPKI adoption reached 60%+ of internet routing by 2024.

MITM on Public Wi-Fi

Public Wi-Fi MITM is simpler: the attacker creates an access point with the same SSID as a popular network ("Starbucks_WiFi"). Devices that auto-connect to known SSIDs will connect to the rogue AP. The attacker's AP provides internet access (routing through legitimate network or LTE) while intercepting all traffic. Defense: always verify the AP's BSSID (MAC address) matches the expected AP. Use a VPN on all public Wi-Fi.

TLS and Certificate Pinning

TLS prevents MITM by requiring the server to present a certificate signed by a trusted CA. An MITM attacker cannot forge a legitimate certificate unless they have compromised a CA. Certificate pinning goes further: the application hardcodes specific certificate fingerprints or public keys, rejecting any certificate not matching the pin — even valid CA-issued ones.

Certificate pinning is used by mobile banking apps, corporate MDM systems, and high-security APIs. It defeats even corporate TLS inspection proxies (which present a CA-signed cert). The tradeoff: pinned certificates must be rotated with app updates.

DNS Cache Poisoning (Kaminsky Attack)

The Kaminsky attack works in three steps:

1. Ask the target DNS resolver to resolve a random subdomain of the target domain (e.g., xyz123.bank.com). The resolver has no cached answer.

2. Immediately flood the resolver with forged responses purporting to be from bank.com's authoritative name server. Each forged response tries a different transaction ID and source port. Because transaction IDs are only 16-bit and source ports were not randomized, 65,536 attempts suffices.

3. One forged response matches the transaction ID. The resolver caches the attacker's glue record as the NS server for bank.com. All future lookups for bank.com resolve to the attacker's IP.

DNS Hijacking

DNS hijacking modifies DNS resolution at a different layer:

— Rogue DHCP server: attacker's DHCP server assigns their DNS server IP to clients.

— Router compromise: attacker modifies router's DNS settings to redirect DNS queries to their server.

— ISP DNS hijacking: some ISPs redirect NXDOMAIN responses to their search/advertising pages.

DNSSEC and DoH/DoT

DNSSEC adds digital signatures to DNS records. The chain of trust runs from the root zone through TLD to domain. A valid DNSSEC signature proves the record was created by the zone owner and hasn't been modified. DNSSEC prevents cache poisoning but not DNS traffic interception (the responses are still observable).

DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt DNS traffic, preventing observation and on-path modification. DoH additionally hides DNS queries from ISPs (queries go to port 443 mixed with HTTPS traffic). Cloudflare (1.1.1.1), Google (8.8.8.8), and NextDNS offer DoH/DoT resolvers.

Volumetric Attacks

Volumetric attacks flood the target's network link with traffic, saturating bandwidth. The traffic doesn't need to be clever — it just needs to be more than the link can handle.

UDP Floods: send large volumes of UDP packets to random ports. Target sends ICMP Port Unreachable for each. The target's CPU and uplink are overwhelmed.

Amplification Attacks: exploit protocols that return large responses to small requests. The attacker spoofs the victim's IP as source. DNS (amplification factor: 50-100x), NTP monlist (100x), SSDP (30x), Memcached (50,000x). Attacker sends 1 Mbps, victim receives 100+ Mbps.

Protocol Attacks

Protocol attacks exploit weaknesses in protocol state machines:

SYN Flood: exhausts server connection table with half-open TCP connections. Defense: SYN cookies (no state allocated until handshake completes).

BGP Flapping: repeatedly withdrawing and announcing routes to cause route instability in BGP.

SSL/TLS Exhaustion: initiating many TLS handshakes without completing them; asymmetric CPU cost (server does more work than client per handshake).

Application Layer (L7) Attacks

Layer 7 attacks look like legitimate traffic but overwhelm application resources:

HTTP Flood: thousands of clients making valid HTTP GET/POST requests. Indistinguishable from legitimate traffic without rate limiting and behavioral analysis.

Slowloris: open many HTTP connections, send partial headers very slowly. Server holds connections open. Most servers have a connection limit — Slowloris fills it with near-zero bandwidth.

XML/JSON Bombs: send deeply nested XML ("billion laughs attack") or JSON that expands exponentially during parsing.

DDoS Mitigation

Anycast scrubbing: Cloudflare, Akamai, AWS Shield absorb attack traffic across their global networks before it reaches the customer.

Rate limiting: limit requests per IP per time window at the network or CDN edge.

BGP blackholing: route the victim IP to null — traffic is dropped at the ISP. The victim goes offline, but the upstream network is protected.

BCP 38: ISPs that filter spoofed source IPs prevent amplification attacks from their customers.

TCP Session Hijacking

In session hijacking, an on-path attacker (after ARP spoofing) observes a TCP session and injects packets with the correct sequence numbers. The attacker can inject commands, steal session cookies, or terminate connections. Modern TLS prevents content injection, but the TCP connection itself can still be terminated by injecting a RST with the right sequence number (RST injection).

TCP Reset Injection

TCP RST (Reset) packets terminate a connection immediately. An attacker who can observe a TCP session (even briefly) can inject a RST with the correct sequence number, abruptly terminating it. The Great Firewall of China uses TCP RST injection to terminate connections to blocked content: rather than silently dropping packets, it sends RSTs to both endpoints, causing connections to fail immediately.

SYN Cookies: Defeating SYN Floods

SYN cookies encode session state in the TCP Initial Sequence Number (ISN) rather than in server memory. The server hashes the 5-tuple + timestamp + secret key to generate the ISN. No connection state is stored until the SYN-ACK is acknowledged. If the ACK arrives with the right ISN, the server recreates the connection state. No backlog = no resource exhaustion.

# Linux SYN cookies
sysctl net.ipv4.tcp_syncookies=1     # Enable SYN cookies
sysctl net.ipv4.tcp_max_syn_backlog  # SYN backlog size
sysctl net.ipv4.tcp_synack_retries   # Reduce retries under flood

# Verify SYN cookie usage:
netstat -s | grep "SYNCookies"

Evil Twin Attack

An attacker creates a Wi-Fi network with the same SSID (network name) and higher signal strength than the legitimate AP. Devices configured to auto-connect to known SSIDs will associate with the stronger signal. The attacker provides internet connectivity (routing via LTE or the legitimate network), so victims don't notice. All plaintext traffic is captured; HTTPS is attempted to be stripped.

PMKID Attack (WPA2/WPA3)

The PMKID (Pairwise Master Key Identifier) is a hash derived from the PMK and BSSID, transmitted in the first EAPOL frame of the WPA2 4-way handshake. The attacker captures a single PMKID packet — without waiting for a client to authenticate. The PMKID can then be attacked offline: crack the WPA2 password with a dictionary attack. Tools: hcxdumptool + hashcat.

WPA3 Dragonfly and Side-Channel Attacks

WPA3 uses the Dragonfly key exchange (SAE - Simultaneous Authentication of Equals), which is resistant to offline dictionary attacks — the password is never transmitted. However, in 2019 researchers found timing side-channels and cache-based side-channels in some Dragonfly implementations (CVE-2019-9494, "Dragonblood"). These have been patched, but demonstrate that even modern protocols have implementation risks.

Pass-the-Hash

Windows NTLM authentication accepts a password hash (NTLM hash) directly — you don't need to crack the password, just capture and replay the hash. After extracting hashes from lsass.exe (local security authority) using Mimikatz, the attacker can authenticate to any system accepting NTLM with that user's hash, without ever knowing the plaintext password.

# Pass-the-hash with impacket (authorized red team only)
python psexec.py -hashes :NTLM_HASH_HERE Administrator@192.168.1.50
# Authenticates as Administrator without knowing the password

# Defense:
# 1. Credential Guard (Windows 10+): protects lsass in a hypervisor-isolated container
# 2. Disable NTLM: force Kerberos everywhere (requires domain)
# 3. Local admin passwords unique per machine (LAPS)
# 4. Privileged Access Workstations (PAW) for admin tasks

EternalBlue and SMB Exploitation

EternalBlue (CVE-2017-0144) is an NSA exploit for a buffer overflow in Windows SMBv1. It allows remote code execution without authentication on Windows XP through Server 2008 R2 (unpatched). WannaCry and NotPetya both used EternalBlue to spread laterally. The patch (MS17-010) was available for 2 months before WannaCry; millions of machines were unpatched.

Network Segmentation as Defense

If every machine can reach every other machine on port 445 (SMB), one compromised host leads to total network compromise. Network segmentation with firewall rules between segments limits lateral movement: servers can't reach client machines, production can't reach development, external DMZ can't reach internal.

The Defense Layers

Perimeter: firewall, IPS, DDoS mitigation. Reduces attack surface exposed to the internet.

Network: VLAN segmentation, ACLs, DHCP snooping, DAI, port security. Limits blast radius within the network.

Host: OS hardening, endpoint protection, host-based firewall, patch management. Reduces vulnerability to exploitation.

Application: TLS, input validation, WAF, authentication. Protects the service itself.

Data: encryption at rest, DLP, access controls. Protects data even if other layers fail.

Detection: SIEM, IDS/IPS, NDR, honeypots. Identifies breaches that bypass preventive controls.

Response: incident response plan, forensics capability, backup/recovery. Limits damage when breaches occur.

Zero Trust Architecture

Zero Trust assumes breach: no device or user is trusted by default, even on the internal network. Every access request is authenticated, authorized, and continuously verified. Network location (inside vs. outside firewall) is not a trust indicator. This model eliminates the "trusted insider" assumption that makes lateral movement so easy.

Network-Based Detection

IDS/IPS: Intrusion Detection/Prevention Systems analyze traffic for attack signatures and anomalies. Signature-based detection catches known attacks; anomaly-based detection flags deviations from normal behavior. Suricata and Snort are leading open-source IDS engines.

NDR (Network Detection and Response): uses machine learning on flow data to detect C2 communication patterns, lateral movement, data exfiltration, and unusual protocol usage. Products: Darktrace, ExtraHop, Vectra.

Honeypots: decoy systems with no legitimate traffic. Any connection to a honeypot is by definition suspicious. Honeytokens (fake credentials, fake API keys) in monitoring can detect credential theft even before the attacker uses them.

SIEM and Log Correlation

Security Information and Event Management (SIEM) aggregates logs from all systems — firewalls, IDS, endpoints, servers, applications — and correlates events across them. A single failed login is noise; 1,000 failed logins across 50 accounts in 10 minutes is a brute-force attack. SIEM detects patterns that individual devices cannot see.