Reconnaissance and Scanning Attacks
Reconnaissance: gathering information about a target before launching an attack. Passive reconnaissance uses publicly available information (OSINT — Open Source Intelligence): WHOIS, DNS records, LinkedIn, social media, Shodan. Active reconnaissance directly probes the target: port scanning (nmap), ping sweeps, OS fingerprinting — these generate traffic and can be detected.
Port scanning: tools like nmap identify which ports are open on a target system. An open port indicates a running service — a potential attack entry point. Mitigation: firewall rules, IDS signatures for port scan patterns.
Network Layer Attacks
DoS (Denial of Service): overwhelming a target with traffic or requests to make it unavailable. DDoS (Distributed DoS): coordinated attack from thousands of compromised systems (botnet). Flood attacks: SYN flood (half-open TCP connections exhaust server resources), ICMP flood (ping flood), UDP flood. Mitigation: rate limiting, upstream filtering, DDoS scrubbing services.
Man-in-the-Middle (MitM): attacker positions themselves between two communicating parties, intercepting and potentially modifying traffic. Methods: ARP poisoning (fake ARP replies redirect traffic), DNS poisoning (fake DNS responses), rogue APs (Evil Twin attack). Mitigation: encryption (TLS/HTTPS makes MitM visible), HTTPS Strict Transport Security, certificate pinning, ARP Dynamic Inspection.
IP spoofing: forging the source IP address of packets. Used in DoS amplification attacks (reflecting responses to the victim's spoofed IP). Mitigation: ingress filtering (ISPs block traffic from their customers with spoofed source IPs — BCP38), uRPF (Unicast Reverse Path Forwarding).
Layer 2 and Wireless Attacks
ARP poisoning (ARP spoofing): sending fake ARP replies to associate the attacker's MAC with a legitimate IP. Victims send traffic to the attacker. Mitigation: Dynamic ARP Inspection (DAI), static ARP entries for critical devices.
MAC flooding: flooding a switch with fake MAC addresses to fill the CAM table. When the table is full, the switch behaves like a hub — flooding all traffic to all ports. Mitigation: port security limiting MAC addresses per port.
VLAN hopping: accessing a VLAN the attacker shouldn't be on. Methods: switch spoofing (attacker's device acts as a switch and negotiates a trunk) or double-tagging (attacker sends frames with two 802.1Q tags — outer tag is stripped, inner tag routes to target VLAN). Mitigation: disable DTP, set explicit access mode, change native VLAN from VLAN 1.
Evil Twin (rogue AP): attacker sets up a wireless AP with the same SSID as a legitimate network. Clients connect to the attacker's AP thinking it's the real network. Mitigation: wireless intrusion detection, client verification (802.1X), HTTPS everywhere.
Deauthentication attack: sending forged 802.11 deauthentication frames to disconnect clients. Used as DoS or to force clients to reconnect to an Evil Twin. Mitigation: 802.11w (Management Frame Protection).