Introduction · Topic 2 of 3

The Most Common Threats to a Router Network

A guide to the threats a MikroTik network faces most often, including scanning, sniffing, spoofing, flooding, brute force and weak management practices.

5 min

In a nutshell

Reconnaissance comes first. A port scan finds open services.
Sniffing is only useful to the attacker when traffic is clear text.
Spoofing fakes an IP, MAC or ARP identity.

What it is

A threat is a way that an attacker can harm the network, and a few threats account for most incidents.

Knowing these threats tells you where to look first when you secure a router. The rest of the course takes each threat in turn and shows the RouterOS feature that answers it.

Most attacks follow the same path. The attacker finds the target, then looks for a weakness, and finally uses that weakness.

How it works

Each common threat attacks a different layer or a different habit of the administrator.

Reconnaissance and sniffing

Reconnaissance is the information gathering step. A port scan sends probes to many ports to see which services answer. Neighbour discovery protocols can also reveal the device name, model and software version to anyone on the same segment.

Sniffing means capturing traffic as it passes. Clear text protocols such as telnet, FTP and plain HTTP expose passwords to anyone who can see the frames.

Spoofing and man in the middle

Spoofing is the act of faking an address. An attacker may fake an IP address, a MAC address or an ARP reply. The goal is to hide the real source, to bypass a filter, or to place the attacker between two hosts.

A man in the middle attack sits on the path between two parties. The attacker reads or changes the traffic and both sides believe they talk to each other directly.

Denial of service

A denial of service attack tries to make a service unavailable. The attacker sends so many packets or connection requests that the router or the server cannot answer real users.

When many hosts take part, it is a distributed attack. Examples you will study later are SYN floods, UDP floods and ICMP smurf attacks.

Brute force and weak credentials

A brute force attack tries many passwords against a login service such as SSH, telnet, FTP or WinBox. It succeeds when users pick weak passwords or when the service is open to the whole internet.

Leaving the built in admin account with its factory password, or any weak password, is the simplest failure of all. Open services that nobody needs add more attack surface.

Rogue devices

A rogue device is one that should not be there. A rogue DHCP server hands out wrong gateway or DNS settings. A rogue access point or a plugged in laptop can bridge an outside attacker into the trusted network.

Threats and the matching defence

Threat	What the attacker does	First defence on RouterOS
Port scan	Probes for open ports	Firewall rules, detection with address lists
Sniffing	Reads clear text	Encrypted protocols such as SSH and HTTPS
Spoofing	Fakes addresses	Drop bogon and invalid sources, ARP settings
Flood	Overloads the service	Connection limits, RAW drops
Brute force	Guesses passwords	Strong passwords, limits, port knocking
Rogue DHCP	Offers wrong settings	DHCP snooping on the bridge

A small set of rules already blocks a lot of this noise.

/ip firewall filter add chain=input connection-state=established,related action=accept
/ip firewall filter add chain=input connection-state=invalid action=drop
/ip firewall filter add chain=input protocol=icmp action=accept
/ip firewall filter add chain=input in-interface=ether1 action=drop
/interface ethernet set ether2 arp=reply-only

The first rule accepts replies to traffic that the router already allowed.
The second rule drops invalid packets.
The third rule accepts ping, which is needed for diagnosis.
The fourth rule drops all other input from the outside interface.
The arp=reply-only setting makes the router answer ARP requests only from hosts that have a static entry in /ip arp.

Exam tip

A rule list is read from the top. Put the accept rules for what you need above the final drop rule, or you will lock yourself out.

What to remember for the exam

Eight facts summarise the threats.

Reconnaissance comes first. A port scan finds open services.
Sniffing is only useful to the attacker when traffic is clear text.
Spoofing fakes an IP, MAC or ARP identity.
A man in the middle attack reads or changes traffic between two parties.
Denial of service exhausts resources. It becomes distributed when many hosts send the traffic.
Brute force targets login services with many guesses.
Default or empty passwords and unneeded open services are the most avoidable weaknesses.
A rogue DHCP server is an example of a rogue device.

Common mistakes

Four mistakes cost administrators the most.

Believing that the internet is the only danger. Many attacks start from inside the LAN, for example a rogue DHCP server or an infected laptop.

Leaving clear text services on. Telnet and FTP send passwords unprotected, so use SSH and encrypted transfer instead.

Skipping the basics. A strong password and a closed service stop far more attacks than clever rules.

Confusing DoS with DDoS. A DoS attack comes from one source. A DDoS attack comes from many, so blocking a single address does not stop it.

Watch out

Rules that drop traffic on the input chain can cut your own management session. Test from a second connection or use safe mode before you leave.

Check yourself

Work through these three questions.

What is the difference between a DoS attack and a DDoS attack?
A DoS attack comes from one source. A DDoS attack comes from many hosts, so blocking one address does not stop it.
Why is sniffing a problem for telnet and FTP?
These protocols send data and passwords in clear text. Anyone who can capture the frames can read them.
What does the setting arp=reply-only on an interface do?
It makes the router answer ARP requests only from hosts that have a static entry in /ip arp.

Topic 2 of 3 in Introduction

Test yourself on Introduction

The full MikroTik MTCSE question bank has 446 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.