Build the idea first, then use the next activity to check it.
How networks get attacked
The attack families you are expected to recognise, grouped by what they abuse rather than by name, and what actually stops each one.
What you will be able to do
- Group common attacks by the property they violate
- Explain why spoofing works and what makes it harder
- Distinguish an on-path attack from simple eavesdropping
- Say why denial of service is a design problem rather than a filtering one
Before this: You should be able to name a threat, a vulnerability and an exploit - see "Threats, vulnerabilities and the words in between".
Why it matters: Both exams ask you to recognise attacks by description rather than perform them. The useful way to hold twenty attack names in your head is not a list - it is knowing which of a handful of assumptions each one breaks, because the defence follows from the assumption.
Networking protocols were designed among people who trusted each other. Most attacks are not clever - they simply do a thing the protocol never thought to check. Grouping them by which assumption they break makes twenty names into four ideas.
One - nobody checks who sent this
A source address in a packet is a claim, not a fact. Nothing in IP verifies it, and the same is true of a MAC address in a frame and the sender field in an ARP reply. Every spoofing attack is this one observation applied somewhere.
| Attack | What is forged | Consequence |
|---|---|---|
| ARP spoofing | The MAC claiming to own an IP | Traffic for the gateway arrives at the attacker instead |
| MAC spoofing | The hardware address of a device | Port-based controls admit the wrong machine |
| IP spoofing | The source address of a packet | Filters that trust source addresses are bypassed |
| DNS spoofing | The answer to a name lookup | A correct name resolves to the wrong address |
What helps is anything that turns a claim into something verifiable, or that limits where a claim can be made from. Filtering source addresses at a boundary, so packets claiming to be internal cannot arrive from outside. Segmentation, so an attacker has to already be in the right broadcast domain for ARP spoofing to reach anything.
Two - the path is trusted
Traffic passes through equipment along the way, and the protocols assume that equipment is neutral. An attacker who arranges to sit on the path breaks that assumption, and the distinction worth holding is between watching and interfering.
| Attack | What the attacker does |
|---|---|
| Eavesdropping | Reads traffic passing by. Passive; leaves no trace |
| On-path attack | Relays traffic between both ends, able to read and modify it |
| Session hijacking | Takes over an established session after authentication has happened |
| Rogue DHCP server | Answers first, and becomes the gateway every new host uses |
Three - resources are unlimited
Every device has finite bandwidth, memory and connection-tracking state. Denial of service attacks target whichever of those runs out first, and the goal is availability rather than access.
- Volume - more traffic than the link can carry. Nothing on your side of the link can fix a full link.
- State - half-open connections that consume tracking resources without completing.
- Amplification - a small request to a third party that produces a large reply aimed at the victim, using spoofing to set the return address.
- Distributed - the same, from enough sources that blocking any one of them achieves nothing.
Four - the person is the easiest way in
No network control addresses this family, which is exactly why it remains effective. It is worth naming them because the mitigation is organisational and needs to be recognised as a security control rather than an HR exercise.
| Attack | Method |
|---|---|
| Phishing | A message that persuades someone to give up credentials or run something |
| Spear phishing | The same, researched and targeted at one person |
| Pretexting | An invented but plausible reason for the request |
| Tailgating | Following someone through a door that requires a badge |
The request that is entirely reasonable
takes a call from someone describing themselves as the new contractor, who cannot get in and needs the wifi password before a meeting starts in five minutes. Everything about the request is normal; the service desk handles it several times a week. What makes it an attack is only that the caller is not who they say, and nothing on the network can tell Priya that.
What to take away for the exam
The questions are recognition questions. Given a description, name the attack; given an attack, name a reasonable mitigation. Working from the four assumptions above is more reliable than memorising a list, because it also handles the ones the syllabus does not mention.
| Assumption | Defence |
|---|---|
| Identity claims are true | Verification, source filtering, segmentation |
| The path is neutral | Authenticate the endpoint, not just encrypt the channel |
| Resources are unlimited | Capacity, rate limiting, upstream help |
| People verify requests | Process, training, a way to check that does not rely on the caller |
Terminology
- Spoofing
- Forging an identifier - address, MAC or name - that nothing verifies.
- On-path attack
- Relaying traffic between two endpoints while able to read and alter it. Defeated by authenticating the far end.
- Amplification
- Using a third party to turn a small spoofed request into a large reply aimed at a victim.
- Social engineering
- Attacking the person rather than the system, by making a false request seem ordinary.
Key takeaways
- Most attacks break one of four assumptions rather than defeating a control.
- Source addresses at every layer are claims, and spoofing is the consequence.
- Encryption stops eavesdropping; only authenticating the far end stops an on-path attack.
- A saturated link cannot be fixed by a rule on your own router.
- Social engineering has no network control, which is why it keeps working.
- Recognise attacks by the assumption they abuse, not by memorising names.
Ready to keep going?
Create a free account to save your progress and take the knowledge check.