Chapter 3 of 6 · MikroTik MTCSE
OSI Layer Attacks
MNDP, DHCP, TCP SYN, UDP, ICMP smurf, brute force and port scan attacks, with the matching defences.
- 5topics
- 26 minfast track
- 3diagrams and exhibits
Topics in this chapter
Take them in order, or jump to the one you need.
- 1MNDP and DHCP Attacks and PreventionUnderstand how MNDP leaks router details, how rogue DHCP servers and DHCP starvation work, and how to stop them with discovery…Diagram5 min
- 2TCP SYN and UDP Attacks and PreventionLearn how TCP SYN floods and UDP floods work, why spoofed sources and amplification make them hard to stop, and how to limit them…Diagram5 min
- 3ICMP Smurf Attacks and PreventionLearn how an ICMP smurf attack uses broadcast addresses and a spoofed source to flood a victim, and how to block it on MikroTik…5 min
- 4FTP, Telnet and SSH Brute Force PreventionLearn how brute force logins on FTP, telnet and SSH work, and how to stop them on MikroTik with staged address lists, limits, SSH…Diagram5 min
- 5Port Scan Detection and PreventionLearn how port scans work, how the RouterOS psd matcher and TCP flag rules detect them, and how to block scanners with address…6 min
About this chapter
What this chapter covers
This chapter takes the common attacks one by one and shows how each works and how RouterOS stops it.
The attacks are grouped by the layer where they act. Some abuse local discovery and addressing on the segment. Others flood the transport layer, abuse ICMP, guess passwords or scan for open ports.
Every page follows the same plan. First the attack is explained, then you see the console rules that prevent or detect it.
How the topics fit together
The attacks range from the local segment up to the services on the router.
The first page covers the Layer 2 and Layer 3 neighbourhood. MNDP leaks information, and DHCP can be abused with rogue servers or starvation.
The second page moves to TCP and UDP floods, where the protocol design is the weakness. The third page shows how ICMP and a broadcast address can multiply a flood.
The last two pages deal with the attacker who wants a way in. Brute force guesses passwords, and port scanning finds the services to guess against.
Many defences repeat. Address lists, connection-limit, raw drops and a final drop rule appear on several pages. Learn them once and recognise them each time.
These pages build on the Firewall chapter. If a rule or an action looks unfamiliar, review the packet flow and the RAW table pages first.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and console examples.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
For each attack, answer three questions in your own words.
- What does the attacker send?
- Why does it work?
- Which rule stops it?
If you have a lab, practise the rules there, and test them with a second device. Never test attack traffic on a network that you do not own.
Ready for more practice?
The full MikroTik MTCSE question bank has 446 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.