Course contents

Chapter 12: Security FundamentalsLesson 2 of 18

Network attacks and mitigation

DoS, spoofing, ARP poisoning, DHCP attacks, VLAN hopping, MAC flooding, STP attacks and social engineering matched to their defences.

Beginner · 10 min read

Technical definition

Attack and mitigation pairs a method an attacker uses, such as flooding a switch with fake MAC addresses, with the control that stops it, such as port security. The CCNA expects you to match them.

Reconnaissance and network attacks

Common attacks and the matching mitigation
Common attacks and the matching mitigationAttack; What it does; Mitigation. Reconnaissance (scans, sniffing): Maps hosts, ports and services before an attack Firewalls and ACLs, disable unused services, IPS, encryption DoS / DDoS: Overwhelms a target so legitimate users cannot reach it Rate limiting, ISP scrubbing, IPS, storm control, redundancy IP or MAC spoofing: Forges a source address to evade filters or impersonate Anti-spoofing ACLs, uRPF, port security, DHCP snooping bindings ARP poisoning (man in the middle): Sends false ARP replies so traffic flows through the attacker Dynamic ARP Inspection with DHCP snooping DHCP starvation and rogue DHCP server: Exhausts the pool or hands out a bad gateway DHCP snooping and port security MAC flooding (CAM overflow): Fills the switch table so it floods frames like a hub Port security to limit MACs per port VLAN hopping: Uses DTP or double tagging to reach another VLAN Disable DTP, set access mode, change the native VLAN, prune VLANs STP manipulation: Injects BPDUs to become root and capture traffic BPDU guard, root guard Rogue router advertisements (IPv6): Hijacks IPv6 traffic with a false gateway RA guardAttackWhat it doesMitigationReconnaissance (scans,sniffing)Maps hosts, ports and services beforean attackFirewalls and ACLs, disable unusedservices, IPS, encryptionDoS / DDoSOverwhelms a target so legitimateusers cannot reach itRate limiting, ISP scrubbing, IPS,storm control, redundancyIP or MAC spoofingForges a source address to evadefilters or impersonateAnti-spoofing ACLs, uRPF, portsecurity, DHCP snooping bindingsARP poisoning (man inthe middle)Sends false ARP replies so trafficflows through the attackerDynamic ARP Inspection with DHCPsnoopingDHCP starvation androgue DHCP serverExhausts the pool or hands out a badgatewayDHCP snooping and port securityMAC flooding (CAMoverflow)Fills the switch table so it floodsframes like a hubPort security to limit MACs per portVLAN hoppingUses DTP or double tagging to reachanother VLANDisable DTP, set access mode, changethe native VLAN, prune VLANsSTP manipulationInjects BPDUs to become root andcapture trafficBPDU guard, root guardRogue routeradvertisements (IPv6)Hijacks IPv6 traffic with a falsegatewayRA guard

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Read each row across: the mitigation is usually a switch security feature covered later in this course.

Attacks on people and devices

Social engineering, malware and password attacks
Social engineering, malware and password attacksAttack; How it works; Mitigation. Phishing: A convincing message tricks a user into giving credentials or running a file User training, email filtering, multi-factor authentication Malware (virus, worm, trojan, ransomware): Malicious code that spreads, hides or encrypts data Patching, endpoint protection, least privilege, offline backups Brute force and dictionary: Guesses passwords by trying many combinations Strong passwords, lockout, rate limiting, MFA Man in the middle: Sits between two parties to read or alter traffic Encryption (TLS, SSH), certificate checks, DAI Rogue access point: An unauthorised AP gives attackers a way in Wireless scanning, 802.1X, port securityAttackHow it worksMitigationPhishingA convincing message tricks a userinto giving credentials or running afileUser training, email filtering,multi-factor authenticationMalware (virus, worm,trojan, ransomware)Malicious code that spreads, hides orencrypts dataPatching, endpoint protection, leastprivilege, offline backupsBrute force anddictionaryGuesses passwords by trying manycombinationsStrong passwords, lockout, ratelimiting, MFAMan in the middleSits between two parties to read oralter trafficEncryption (TLS, SSH), certificatechecks, DAIRogue access pointAn unauthorised AP gives attackers away inWireless scanning, 802.1X, portsecurity

On small screens, swipe sideways or focus the diagram and use the arrow keys.

People are often the weakest link, so awareness training is part of the mitigation.

Layered defence

  1. Harden devices: strong credentials, SSH, disable unused ports and services.
  2. Control access: AAA, 802.1X, multi-factor authentication.
  3. Filter traffic: ACLs and firewalls.
  4. Protect Layer 2: port security, DHCP snooping, DAI, BPDU guard.
  5. Monitor and respond: logs, SNMP, IPS and a plan for when something fails.

Test yourself

Predict · scenario 1

Which feature stops an attacker from sending false ARP replies on a VLAN?

Predict · scenario 2

An attacker floods a switch with thousands of fake source MAC addresses. Which control limits this?

Predict · scenario 3

Which pair is correct for VLAN hopping?

FAQ

What is the difference between DoS and DDoS?
A DoS attack comes from one source. A DDoS attack uses many sources, usually compromised devices in a botnet, so it is harder to block by address.
What is the difference between a threat and an attack?
A threat is something that could cause harm, such as a hacker or malware. An attack is the act of exploiting a vulnerability. Mitigation reduces the likelihood or impact of either.
Which single measure helps most?
There is no single one. Layered defence combines patching, strong authentication, segmentation, filtering and monitoring, so one failure does not give access.