Network Attacks: Protocol, DoS, DDoS and MITM

What it is

Network attacks abuse the way protocols work, flood a target with traffic, or sit between two parties to read or change what they send.

This page covers four groups. Protocol based attacks misuse a weakness in a protocol, denial of service attacks stop a service from working, and distributed attacks do the same from many sources. Man in the middle attacks intercept communication.

For each group, know the idea, a typical example, and how it looks in the data.

How it works

Each attack targets a different goal, and each leaves different traces.

Protocol based attacks

Protocol attacks exploit how a protocol is designed, not a bug in one product.

• SYN flood sends many TCP SYN packets and never completes the handshake. The target holds half open connections until its table is full.
• ARP spoofing sends false ARP replies so that other hosts send their traffic to the attacker.
• DNS spoofing or cache poisoning places false answers in a resolver, so users are sent to the wrong address.
• ICMP abuse, such as sending very large or very many echo requests, can overload or probe a target.
• IP spoofing forges the source address, often to hide the sender or to aim replies at a victim.

Denial of service (DoS)

A denial of service attack makes a service unavailable to its users, which is an attack on availability. It can work by overloading bandwidth, exhausting connection tables or crashing the service with malformed input.

A single source is sending the traffic, so blocking that source often stops it.

Distributed denial of service (DDoS)

A distributed denial of service attack uses many sources at once, often a botnet of compromised devices. Because the traffic comes from thousands of addresses, blocking one address does nothing.

A reflection and amplification attack is a common form. The attacker sends small requests with a forged source address, which is the victim.

Servers reply with much larger responses to the victim. DNS and NTP servers have been misused this way.

Defences include rate limiting, filtering at the provider, using a scrubbing service and spreading load across many servers.

Man in the middle (MITM)

In a man in the middle attack, the attacker places a device between two parties. The attacker can read the traffic, change it, or both, while each side thinks it is talking to the other directly.

Common ways to get into the path are ARP spoofing on a local network, a rogue wireless access point, or DNS tampering. Encryption with properly validated certificates is the main defence, since the attacker cannot read or change protected traffic without the keys.

On a Cisco switch, features such as Dynamic ARP Inspection and DHCP snooping help against ARP based attacks. Port security limits which devices can connect.

Reading the signs

• A sudden jump in traffic or connections points to DoS or DDoS.
• Many half open TCP connections suggest a SYN flood.
• Two different MAC addresses claiming the same IP address suggest ARP spoofing.
• Certificate warnings in a browser can point to interception.