Network Attacks & Defenses

ARP spoofing: hijacking the local network

ARP has no authentication built in. An attacker on the same local network can send forged ARP replies claiming to own the gateway's IP address — every other device updates its ARP table to match, and now routes its internet-bound traffic through the attacker first.

IP	Resolves to (MAC)

Port scanning: probing with a half-open handshake

A SYN scan reuses the exact first step of the TCP handshake: send a SYN, see what comes back, and never finish connecting.

Port	Guessed service	Response	Scanner concludes

Notice ports 8080 and 3306 both show up "closed-looking" for different reasons: 8080 gets an actual RST (nothing's listening), while 3306 gets no response at all because a firewall rule is silently DROPping it — a scanner genuinely can't tell "dropped by policy" from "packet lost in transit." That ambiguity is exactly why DROP is preferred over REJECT for stealth: a REJECTed port and a naturally closed port look identical to a scanner.

SYN flood: exhausting the half-open connection table

Every server has to remember something for every SYN it acknowledges, while waiting for the final ACK — that's the SYN_RECEIVED state from the TCP Handshake page. An attacker sends a flood of SYNs and never sends that final ACK, filling the table with connections that will never complete until legitimate SYNs have nowhere left to go.

IP spoofing & ingress filtering

Nothing checks that a packet's source address is genuine — routing only ever looks at the destination. That's what lets an attacker forge a SYN flood's source addresses, and what powers amplification attacks: send a small request with a victim's spoofed address as the source, and let a third party's large reply flood the victim instead of the attacker.

The fix belongs at the network edge, not the destination: an ISP's router should only forward packets whose source address genuinely belongs to that customer's assigned range — a practice called ingress filtering (BCP38). It has to be deployed at the source network to work — a victim's own firewall can't undo a spoofed source address after the fact.

DDoS: three different things people lump together

Category	What it saturates	Example
Volumetric	Raw bandwidth	DNS/NTP amplification flooding the link itself
Protocol	Connection-state tables	SYN flood, above
Application-layer	Server-side request processing	A flood of real-looking HTTP requests — much harder to filter by IP or pattern alone

Common gotchas

• Port scans are usually reconnaissance, not the attack itself. Seeing repeated scans in logs is an early-warning signal worth acting on, not background noise to ignore.
• ARP spoofing can't cross the internet. It only works within the same local broadcast domain — exactly why network segmentation (VLANs) limits how far a single compromised device can reach.
• Ingress filtering is a collective-action problem. An unfiltered network mostly harms other networks' targets, not its own users — which is a large part of why BCP38 adoption has historically been incomplete despite being well understood for decades.
• A firewall doesn't stop a volumetric flood. If the attack saturates the link before packets even reach your firewall, its rules never get evaluated — that needs upstream ISP-level or CDN/scrubbing-service mitigation instead.