Common Network Attacks: DoS, Spoofing, and MITM

A Denial-of-Service (DoS) attack aims to make a system, service, or network unavailable to legitimate users by overwhelming it with traffic or exploiting a vulnerability that causes it to crash. DoS attacks target the Availability pillar of the CIA triad. A single-source DoS is relatively easy to block by rate-limiting the source IP; however, many modern attacks use multiple sources simultaneously to make mitigation much harder.

A DDoS attack uses thousands or millions of compromised devices (a botnet) to flood a target from many different source addresses simultaneously. This makes blocking by source IP impractical. DDoS attacks are categorized as volumetric (floods bandwidth, e.g., UDP flood), protocol (exhausts stateful resources, e.g., SYN flood), or application-layer (exhausts server capacity with valid-looking HTTP requests, e.g., Slowloris). Mitigation services like Cloudflare, Akamai, and AWS Shield absorb volumetric attacks before they reach the origin.

Amplification attacks exploit protocols that produce much larger responses than the initial request. DNS amplification uses a small UDP query to generate a response up to 70x larger, all directed at the victim. NTP monlist amplification can achieve a 4,000x amplification factor. The attacker spoofs the victim's IP as the source address so that thousands of reflectors send their large replies to the victim — this is why it is also called a reflection attack. Mitigation includes BCP38 (ISP-level source address validation) and disabling amplification services.

IP spoofing is the act of crafting packets with a forged source IP address. Spoofing is used in DoS/DDoS reflection attacks, to bypass IP-based access control lists, and to disguise the attacker's true location. Raw socket privileges are required to send spoofed packets. Defenses include ingress filtering (BCP38), which instructs ISPs and routers to drop packets arriving on an interface with a source IP that could not legitimately originate from that network. Stateful firewalls also help by rejecting unsolicited inbound packets that do not match established sessions.

ARP spoofing (also called ARP poisoning) involves sending unsolicited ARP replies that associate the attacker's MAC address with a legitimate IP address. Hosts that receive the fake ARP update their ARP cache and send traffic destined for that IP to the attacker's MAC address instead. This enables man-in-the-middle attacks on local segments. Tools like Arpspoof, Ettercap, and Bettercap automate this attack. Defenses include Dynamic ARP Inspection (DAI) on managed switches, which validates ARP packets against a trusted DHCP snooping binding table.

A man-in-the-middle (MitM) attack occurs when an attacker secretly relays and potentially alters communications between two parties who each believe they are communicating directly. MitM can be achieved through ARP spoofing, DNS spoofing, rogue Wi-Fi access points, or BGP route hijacking. Once positioned in the middle, the attacker can eavesdrop, inject content, strip encryption (SSL stripping), or replay credentials. The key defense is mutual authentication and encryption — TLS with valid certificates prevents most MitM attacks because the client can verify the server's identity.

DNS cache poisoning injects malicious DNS records into a resolver's cache so that legitimate domain names resolve to attacker-controlled IP addresses. The classic Kaminsky attack (2008) exploited predictable transaction IDs to poison resolvers at scale. When a user's resolver is poisoned, they are redirected to fake sites that may steal credentials or serve malware. DNSSEC (DNS Security Extensions) digitally signs DNS records so resolvers can verify authenticity, and DNS over HTTPS (DoH) prevents on-path interception of queries.

An on-path (in-path) attacker has a network position that allows them to see and modify traffic in transit — they are physically or logically between the two communicating endpoints. ARP spoofing creates an on-path position on a local segment. An off-path attacker cannot see the traffic but may attempt blind attacks, such as injecting spoofed TCP RST packets to tear down connections using guessed sequence numbers. TLS mitigates both scenarios because even if traffic is intercepted, it cannot be decrypted or forged without the private key.

BGP (Border Gateway Protocol) hijacking occurs when a malicious or misconfigured Autonomous System announces more-specific IP prefixes to attract traffic destined for another organization. This can redirect internet-wide traffic through an attacker's network. BGP hijacking has been used to intercept cryptocurrency transactions, steal email, and redirect bank traffic. Defenses include RPKI (Resource Public Key Infrastructure), which cryptographically validates route origin authorizations, and monitoring BGP announcements for unexpected changes.

A SYN flood exploits the TCP three-way handshake by sending many SYN packets with spoofed source IPs, causing the server to allocate state for half-open connections (waiting for ACKs that never arrive). The server's connection table fills up and it cannot accept new legitimate connections. Defenses include SYN cookies (server encodes state in the SYN-ACK's sequence number and only allocates resources after the ACK is received), reducing the SYN timeout, and rate-limiting SYN packets per source address.

Detecting DoS, spoofing, and MitM attacks requires visibility at multiple points. NetFlow/IPFIX data reveals sudden traffic spikes from many sources. SIEM correlation rules can alert on anomalous ARP activity (one MAC claiming many IPs) or DNS responses with suspiciously short TTLs. IDS/IPS signatures detect SYN floods and ARP spoofing tools. Response actions include rate-limiting at edge routers, activating DDoS scrubbing services, isolating affected segments, and re-enabling dynamic ARP inspection or flushing poisoned caches.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: DDoS attacks use botnets to overwhelm targets from many sources and are categorized as volumetric, protocol, or application-layer, ARP spoofing poisons local network caches to enable MitM attacks and is mitigated by Dynamic ARP Inspection, and SYN floods exhaust server connection state and are defended with SYN cookies and rate-limiting. Next up we explore Wi-Fi security protocols from WEP through WPA3.