Network Attacks and Defences

Introduction

The internet was designed for cooperation, and many of its early protocols assume honesty. Attackers exploit this. This lesson is for defenders: understanding the attacks is the first step to stopping them. Never test these techniques against systems you do not own or have permission to test.

Denial of service (DoS and DDoS)

A denial-of-service attack tries to make a service unavailable. A distributed one (DDoS) uses many machines, often a botnet of infected devices.

Types:

• Volumetric: flood the target's bandwidth with huge traffic.
• Protocol attacks: abuse protocol behaviour, such as a SYN flood that starts countless TCP handshakes and never finishes them, exhausting server resources.
• Application-layer attacks: many requests that look like legitimate users but target expensive pages, such as search or login.
• Amplification and reflection: the attacker sends small requests with the victim's forged address to servers that reply with much larger responses, which pile onto the victim.

Defences:

• Use a CDN or DDoS protection service with large capacity to absorb and filter floods.
• Rate limiting and bot detection on sensitive endpoints.
• Auto scaling and efficient, cached pages.
• Filter forged source addresses at the network edge, which providers can do.
• Have a plan and contacts ready before an attack.

Name and routing attacks

• DNS spoofing or cache poisoning: feeding false answers so users reach a fake site. Defences: DNSSEC (signing DNS data so it can be verified), secure resolvers, randomised ports and IDs, and HTTPS, because a fake site without a valid certificate triggers a warning.
• Domain hijacking: taking over a domain through the registrar account. Defences: strong registrar security, MFA, registry locks and monitoring.
• BGP hijacking: a network announces routes for addresses it does not own, pulling traffic toward itself. Defences: route filtering, RPKI (cryptographic validation of who may announce which addresses), and monitoring.

Local network attacks

• Eavesdropping and man-in-the-middle: on open Wi-Fi or compromised networks. Defences: TLS everywhere, certificate validation, VPNs, WPA3.
• ARP spoofing: tricking devices on a local network into sending traffic through the attacker. Defences: network segmentation, switch protections, encryption.
• Rogue access points and evil twins: fake Wi-Fi hotspots. Defences: verify networks, use a VPN, and use enterprise authentication where possible.

Application and perimeter defences

• Firewalls: allow only needed traffic, with default deny.
• Web application firewalls (WAF): inspect HTTP traffic for attack patterns such as injection attempts.
• Intrusion detection and prevention systems: spot known attack signatures and unusual behaviour.
• Segmentation and zero trust: limit how far an intruder can move.
• Patching exposed systems quickly, because attackers scan the internet constantly for known flaws.

See and respond

Defence is not only blocking:

• Collect logs from firewalls, DNS, servers and applications in one place.
• Baseline normal traffic so you can spot unusual patterns.
• Alert on suspicious events, such as sudden traffic spikes or traffic to unusual destinations.
• Have an incident response plan and practise it.
• Share threat information with trusted communities and your providers.

A layered view

Try it yourself

For a website you run or know, list its exposed parts: domain registrar, DNS, CDN, servers and the application. For each, write one attack that could affect it and one defence that is or is not in place.

Summary

• Attacks include DDoS, DNS and BGP manipulation, local network spoofing and application abuse.
• Defences are layered: DDoS protection, rate limits, DNSSEC, RPKI, TLS, firewalls, WAFs and segmentation.
• Logging, baselines, alerts and a practised response plan turn defences into resilience.