Network Security
Beginner 16 min read Network Security
Network Attack Vectors
Map how attackers actually reach you: scanning, spoofing, MITM, DoS, and rogue infrastructure — and what each vector requires from you before it lands.
attack surfaceport scanningARP spoofingman-in-the-middleDoSrogue devices
Introduction
What is this?
The network attack surface is everything reachable over the wire before application logic is even involved: exposed ports, weak link security, spoofable protocols, and unmanaged devices.
Motivation
Why do you need it?
- Whole classes of incidents end a kilometer before the web server: a DHCP storm, an ARP spoof, a rogue access point.
- Understanding the vectors tells you which defensive controls (firewalls, segmentation, 802.1X) actually pay rent.
- Incident responders trace these vectors daily; knowing them is the language of a security role.
Think about it
Mental model
Imagine
A castle wall with many doors
Think of
Every open postern is a vector
You can patrol the main gate all day and still lose through the delivery door.
Mechanics
How it works
- Reconnaissance usually starts with a scan: hosts answer probes, open ports reveal services, service banners reveal versions.
- Layer-2 vectors (ARP spoofing, CDP/LLDP abuse, MAC flooding) exploit trusting switches and unencrypted discovery.
- Layer-3 vectors include source-address spoofing, forged ICMP redirects, and route hijacking on networks that accept unsolicited updates.
- Availability attacks (SYN floods, reflection/amplification) target the capacity of links, firewalls, or state tables.
The path from an attacker's probe to a reachable service
Reconping sweep and port scan find listeners
Identifybanner grab nails the service and version
Targetpick the weakest owned service
Enumeratecredentials, trust, adjacent hosts
Exploitmove from reachable to owned
Real world
In production
- A security team continuously scans its own perimeter and patches or removes the top 1% of exposed services.
- A network engineer applies DHCP snooping and ARP inspection on the access layer to neutralize spoofing.
- A red team pivots from an exposed VPN concentrator into the DMZ during an authorized engagement.
Guidelines
Best practices
- Close everything and open only what routes need — measure risk by reachable surface, not by firewall rules.
- Put management planes (SNMP, SSH, admin UIs) on a separate network or VLAN with ACLs.
- Enable port security / 802.1X at the access layer so a stranger's laptop cannot plug into the trust zone.
- Alias host authentication: block ICMP redirects and BGP route-leaks with route filters and RPKI where available.
Watch out
Common mistakes
- Treating the firewall as the whole story while the Wi-Fi and the printer share the server VLAN.
- Believing 'internal network' means trusted — internal-pivot is the default in modern incidents.
- Leaving default credentials or banner-leaked versions on reachable services.
- Forgetting IPv6: a dual-stack host can have an unmanaged, firewalled IPv6 exposure.
When things break
Debugging tips
- From your own machine, nc -zv <host> <port> confirms reachability locally before blaming the firewall.
- traceroute the path; a hop that disappears under packet-size changes suggests a filtering midpoint.
- When a scan shows nothing but users report hangs, check for stateful filtering that drops RSTs.
Security
Security considerations
- Only scan networks you own or have written authorization for; scanning third parties, even benignly, can be illegal.
- Pen-test contracts must list exact IP ranges and time windows before any probe runs.
- Do not run exploit tools against live customer segments; use the staged labs that accompany this track.
Interviews
Interview checkpoint
Test yourself
Quick quiz
0/2
1
Which protocol is frequently abused for reflection/amplification attacks?
2
An attacker on the same switch segment sends forged ARP replies. What is the goal?
Go deeper