netskillup
← Module 06 · Security & Encryption

Common Attacks: ARP Spoofing, MITM, DDoS

Three attacks working at three different layers, and a good final tour of exactly how much this whole site's mechanisms exist to defend against.

ARP spoofing: A fake directory desk

Picture someone setting up a fake "building directory" sign, so people asking "which office is this?" get sent to the wrong place entirely. ARP (Address Resolution Protocol) has no authentication built in: any device on a segment can send an unsolicited ARP reply, and other devices will simply believe it. An attacker exploits this by sending forged replies claiming to own the gateway's IP address, poisoning the victim's ARP cache so traffic meant for the real gateway gets sent to the attacker's MAC (Media Access Control) address instead.

VICTIM ATTACKER REAL GATEWAY 1. Forged ARP reply: "I'm 192.168.1.1" 2. Victim's traffic goes to the attacker instead
The real gateway is never even contacted. Its ARP cache entry has simply been overwritten with a lie.

Man-in-the-middle (MITM): A secret relay

Once an attacker can redirect traffic, whether through ARP spoofing, a rogue WiFi access point, or another method entirely, they can sit silently in the middle of a conversation, relaying everything between two parties who both believe they're talking directly to each other. The attacker can read the traffic, and if it isn't encrypted, modify it in transit too.

VICTIM ATTACKER SERVER both sides believe this connection is direct and private the attacker relays everything, and can read or modify it
The traffic actually takes the solid path through the attacker, never the dashed one either side believes it's taking. TLS (see TLS/SSL Handshake) defeats this by encrypting the payload and tying the certificate to a specific domain, so a relayed connection either fails validation or shows content the attacker still can't read.

DDoS: Flooding the doorway

A DoS (Denial of Service) attack overwhelms a target with more traffic or requests than it can handle, from a single source. A DDoS does the same thing from many sources at once, often a botnet of compromised devices, which makes it far harder to stop by simply blocking one IP address. Either way the goal is the same: legitimate users can't get through, because the doorway is jammed with far more visitors than it can process.

BOTNET SERVER YOU a real request, lost in the flood every time
The server isn't broken. It's just buried, with no spare capacity left to answer a legitimate request even though nothing about that request was wrong.
AttackWhat it exploitsPrimary defense
ARP SpoofingARP has no authentication for repliesDynamic ARP Inspection (DAI), switch port security
MITMTrust assumptions between two partiesTLS/certificate validation, avoiding untrusted networks
DDoSFinite server and network capacityRate limiting, traffic scrubbing, CDN/anycast distribution
WHY EVERY EARLIER TOPIC IN THIS MODULE EXISTS BECAUSE OF ATTACKS LIKE THESE

PKI and certificates exist so a relayed connection can be detected. TLS exists so even a successfully relayed connection can't be read. IPsec and VPNs exist so an entire network path can be trusted even when it crosses infrastructure nobody involved actually controls. Firewalls exist to stop unwanted traffic, flood or otherwise, before it ever reaches something that matters. None of it is abstract. It's all a direct response to attacks exactly like these three.