Common Protocols & Their Weaknesses¶

Many foundational internet protocols were designed in an era of implicit trust. Knowing their weaknesses tells you what to monitor and where to add encryption.

Cleartext vs. Encrypted Equivalents¶

Rule of thumb: if a protocol sends credentials or data in cleartext, anyone on the path (a malicious Wi-Fi hotspot, a compromised router) can read it.

DNS — The Internet's Phone Book¶

DNS resolves names (example.com) to IPs. Because classic DNS is unauthenticated and unencrypted, it's a frequent target:

• DNS spoofing / cache poisoning — forge responses to redirect victims.
• DNS tunneling — smuggle data out through DNS queries (a stealthy exfil channel).
• Defenses: DNSSEC (authenticity), DNS over HTTPS/TLS (DoH/DoT), and monitoring for abnormal query volumes.

ARP — Trust on the Local Network¶

ARP maps IP addresses to MAC addresses on a LAN. It has no authentication, enabling ARP spoofing: an attacker claims to be the gateway and intercepts local traffic (a man-in-the-middle position). Defenses include dynamic ARP inspection and static ARP entries on critical hosts.

DHCP¶

Hands out IP configuration. A rogue DHCP server can point victims at a malicious DNS or gateway. Defend with DHCP snooping on managed switches.

ICMP¶

The protocol behind ping and traceroute. Useful for diagnostics, but also for reconnaissance (host discovery) and covert channels. Rate-limit and monitor rather than blanket-block — total ICMP blocking breaks legitimate troubleshooting.

Takeaway¶

For every protocol on your network, ask:

1. 1.Does it encrypt data in transit?
2. 2.Does it authenticate both parties?
3. 3.Is there a secure alternative I should mandate?

Most "easy wins" in network security come from retiring cleartext protocols.