Common Network Threats and Attack Techniques

A hospital's network is degraded to unusable within 15 minutes of a visitor plugging in a laptop. By the time IT reacts, patient monitoring systems are offline. Root cause: the visitor ran a tool that sent hundreds of thousands of bogus MAC addresses, overflowing every switch's MAC table. Once full, switches flooded all traffic to all ports — a perfect sniffing environment and a DoS in one.

That attack has a name — MAC flooding — and a defense — port security. The pattern repeats across every Layer 2 attack: specific technique, specific impact, specific mitigation. This lesson covers the attacks you'll actually encounter defending enterprise networks.

#Layer 2 Attacks#link

#MAC Flooding in Detail#link

The MAC table has a fixed size — typically 8K to 32K entries depending on the switch model. Flooding it with bogus entries takes seconds. Once full, the switch falls back to flooding — it can't learn new entries, so every frame goes everywhere. The attacker now sees all traffic, and legitimate hosts see degraded performance.

#Layer 3 Attacks#link

• ▪IP spoofing — source IP forged to hide identity or impersonate another host
• ▪Smurf attack — ICMP to broadcast address, spoofed source → amplified DoS
• ▪SYN flood — opens thousands of half-open TCP connections, exhausts server resources
• ▪UDP flood — floods target with UDP packets
• ▪ICMP flood — floods target with ping traffic
• ▪Reflection/amplification — sends small requests with spoofed source to amplification services (DNS, NTP, memcached)

The amplification attacks deserve special note. The attacker sends a small query with a spoofed source IP (the victim's IP) to an open public service that replies with a much larger response. The victim receives huge traffic from the reflector — not from the attacker. Mitigation includes BCP38 (source address validation at ISPs), blocking open resolvers, and disabling unused services.

#Attack Chain: From Recon to Impact#link

1. Reconnaissance — scan network, identify hosts and services
2. Weaponization — prepare exploit for a specific vulnerability
3. Delivery — get the payload onto a target (phishing, USB, direct exploit)
4. Exploitation — trigger the vulnerability to gain code execution
5. Installation — establish persistence (backdoor, scheduled task, service)
6. Command and Control (C2) — communicate back to attacker
7. Actions on objectives — exfiltrate data, encrypt for ransom, pivot to more systems

The Lockheed Martin Cyber Kill Chain gives this flow its name. Every stage is a chance for defenders to detect or block. The earlier you catch the attacker, the cheaper the remediation. That's why segmentation, monitoring, and least-privilege matter — they slow the chain at every step.

#Check Your Understanding#link

#Common Mistakes#link

• ▪Assuming a firewall alone stops Layer 2 attacks — it can't see them
• ▪Not configuring port security on access ports — leaves MAC flooding wide open
• ▪Leaving DTP enabled on access ports — enables VLAN hopping
• ▪Ignoring ARP attacks as 'old news' — still common in flat networks without DAI
• ▪Treating each attack in isolation — real attackers chain multiple techniques