Network Security · Topic 4 of 7
DoS, Layer 2 and Spoofing Attacks
Recognize DoS and DDoS, VLAN hopping, MAC flooding, ARP poisoning, DNS poisoning, rogue DHCP servers and access points, evil twins and on-path attacks.
- 5 min
- DoS targets availability. DDoS uses many sources, often a botnet.
- VLAN hopping uses switch spoofing or double tagging. Disable trunk negotiation to prevent it.
- MAC flooding fills the switch table so frames are flooded. Port security helps.
What it is
Many network attacks abuse the way protocols trust each other. Switches trust Media Access Control (MAC) addresses, hosts trust Address Resolution Protocol (ARP) replies, and clients trust the first Dynamic Host Configuration Protocol (DHCP) or Domain Name System (DNS) answer they receive.
The exam gives a symptom and asks you to name the attack. This page lists each attack, how it works and what impact it has.
How it works
Denial of service
A denial of service (DoS) attack tries to make a service unavailable by exhausting its bandwidth, connections or resources. A distributed DoS (DDoS) uses many machines at once, often a botnet of infected devices controlled through command and control servers.
Typical forms include flooding a server with connection requests, and amplification attacks, where small spoofed requests make third party servers send large replies to the victim. The goal is a hit on availability.
Virtual LAN (VLAN) hopping
VLAN hopping lets an attacker reach a VLAN that they should not access. Two methods are common.
| Method | How it works |
|---|---|
| Switch spoofing | The attacker's device pretends to be a switch and negotiates a trunk, so it receives traffic for all VLANs |
| Double tagging | The attacker adds two VLAN tags, and the first switch removes one, forwarding the frame into another VLAN |
Prevention is to disable automatic trunk negotiation, set access ports to access mode, and keep unused ports in an unused VLAN. Do not use the native VLAN for user traffic.
MAC flooding
A switch has a limited MAC address table. In MAC flooding, an attacker sends frames with many fake source addresses until the table is full. The switch may then flood frames out of every port, letting the attacker see traffic meant for others.
Port security, which limits the number of MAC addresses per port, defends against it.
ARP poisoning and spoofing
ARP has no authentication. In ARP spoofing, the attacker sends false replies that link their MAC address to another host's Internet Protocol (IP) address, often the default gateway.
Victims then send traffic to the attacker, which can read or alter it. The poisoned cache entries make this an on-path attack. Dynamic ARP inspection on switches blocks invalid ARP replies.
DNS poisoning and spoofing
In DNS poisoning, an attacker inserts a false record into a resolver's cache, so users who ask for a real name receive the attacker's address. DNS spoofing is the broader act of returning forged answers.
Defenses include DNS Security Extensions (DNSSEC), patched DNS software and restricting who can query or update the servers.
Rogue devices and services
A rogue DHCP server hands out wrong addresses, gateways or DNS servers, which redirects clients. DHCP snooping lets a switch accept DHCP replies only from trusted ports.
A rogue access point (AP) is an unauthorized wireless device plugged into the network, which may bypass security controls. An evil twin is an access point that copies the name of a real network to lure users into connecting, so the attacker can capture their traffic.
On-path attacks
An on-path attack (formerly called man in the middle) places the attacker between two parties. The attacker can read, change or inject traffic. ARP spoofing, rogue gateways and evil twins can all create this position.
Encryption with certificate checks, such as Transport Layer Security (TLS), limits the damage because the attacker cannot read or silently alter protected traffic.
What to remember for the exam
- DoS targets availability. DDoS uses many sources, often a botnet.
- VLAN hopping uses switch spoofing or double tagging. Disable trunk negotiation to prevent it.
- MAC flooding fills the switch table so frames are flooded. Port security helps.
- ARP spoofing links an attacker's MAC to another IP. Dynamic ARP inspection helps.
- DNS poisoning inserts false records in a cache. DNSSEC helps.
- A rogue DHCP server gives out bad settings. DHCP snooping helps.
- A rogue access point is unauthorized. An evil twin copies a real network name (Service Set Identifier, SSID).
- An on-path attack sits between two parties and can read or alter traffic.
Match the symptom to the attack. "All users got the wrong gateway" is rogue DHCP, "the switch behaves like a hub" is MAC flooding, and "users reach a fake site for a real name" is DNS poisoning.
Common mistakes
Calling a DoS attack a data theft. It targets availability, not confidentiality.
Mixing up ARP and DNS poisoning. ARP poisoning works on the local network by MAC address. DNS poisoning works on name resolution.
Treating a rogue access point and an evil twin as the same. A rogue AP is an unapproved device on the network. An evil twin impersonates a legitimate network.
Forgetting encryption as a defense. Encryption does not stop interception, but it stops the attacker reading the content.
Leaving trunk negotiation enabled on user ports. It enables switch spoofing.
Do not rely on a hidden SSID or a name match to trust a wireless network. An attacker can copy any visible name.
Check yourself
Work through these three.
Which attack fills the switch MAC address table so that frames are flooded?
MAC flooding, which port security helps to prevent.
Which switch feature prevents rogue DHCP servers?
DHCP snooping, which accepts DHCP replies only from trusted ports.
What is an evil twin?
A malicious access point that copies the name of a legitimate network to lure users to connect.
Topic 4 of 7 in Network Security
Test yourself on Network Security
The full CompTIA Network+ N10-009 question bank has 910 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.