Attacks against availability and confidentiality at the network layer — and how to blunt them.
A DoS overwhelms a target so legitimate users can't reach it. A DDoS uses many distributed sources (a botnet), making it far harder to block.
| Type | Mechanism | Example |
|---|---|---|
| Volumetric | Saturate bandwidth | UDP/ICMP floods, amplification |
| Protocol | Exhaust connection state | SYN flood |
| Application | Exhaust app resources | HTTP request floods |
Amplification abuses services (DNS, NTP, memcached) that return large responses to small spoofed requests, multiplying the attack's volume.
The attacker secretly positions between two parties to read or alter traffic.
Techniques: ARP spoofing (LAN), rogue Wi-Fi access points, DNS spoofing, BGP hijacking.
Capturing network traffic. On a switched network, attackers may use ARP spoofing or port mirroring; on Wi-Fi, they capture radio frames. Tools like Wireshark are legitimate for defenders analyzing their own networks.
Defense: encrypt everything in transit. If traffic is TLS-protected, sniffing yields ciphertext, not secrets.
Most network attacks are defeated by two habits: encrypt and authenticate all traffic, and monitor for anomalies. Confidentiality and integrity come from crypto; availability comes from capacity, filtering, and upstream scrubbing.