Simple explanation
This lesson covers the attack types that specifically target network infrastructure and traffic, and the corresponding defenses.
Technical explanation
- On-path attack (formerly "man-in-the-middle") — intercepting traffic between two parties, often via ARP spoofing (poisoning the ARP table to redirect local traffic through the attacker) or a rogue DHCP server (handing out malicious gateway/DNS settings).
- DNS poisoning/spoofing — corrupting DNS responses to redirect victims to malicious destinations.
- VLAN hopping — an attacker crossing VLAN boundaries they shouldn't be able to reach, often by exploiting trunk misconfiguration.
- DDoS (Distributed Denial of Service) — overwhelming a target with traffic from many sources simultaneously; mitigated via traffic scrubbing services, rate limiting, and redundant capacity.
- Evil twin — a rogue access point mimicking a legitimate SSID to trick users into connecting to it.
- Deauthentication attack — forcibly disconnecting wireless clients, often as a precursor to an evil twin or credential-capture attack.
- Rogue DHCP/rogue access point — unauthorized devices providing services (address assignment, wireless access) that shouldn't exist on the network, either maliciously or through simple misconfiguration.
Mitigations: DHCP snooping (a switch feature that only allows DHCP responses from trusted, authorized ports, blocking rogue DHCP servers), Dynamic ARP Inspection (validating ARP packets against a trusted binding table to prevent ARP spoofing), port security, 802.1X, and proper VLAN/trunk configuration to prevent hopping.
Synonyms / related terms
| Term | Means | |---|---| | ARP spoofing | Corrupting ARP tables to intercept local traffic | | Evil twin | A rogue AP mimicking a legitimate network name | | DHCP snooping | Switch feature blocking unauthorized DHCP servers |
Concept Check
"Users on a wireless network suddenly connect to what looks like the correct SSID, but their traffic is being intercepted." This describes an evil twin attack — not simply an on-path attack in the wired sense, though the eventual effect is similar (interception). The specific wireless mechanism (a rogue AP broadcasting the same/similar SSID) is what distinguishes this scenario and points toward the correct mitigation (wireless intrusion detection, client isolation, certificate-based authentication).
Interview-style Q&A
Q: Why is DHCP snooping considered a foundational switch security feature rather than an optional add-on? A: "A rogue DHCP server is an extremely low-effort, high-impact attack — plug in one misconfigured or malicious device and it can silently redirect every new client's default gateway and DNS server. DHCP snooping closes that gap by trusting DHCP responses only from explicitly designated ports (like the uplink to the real DHCP server), which is cheap to configure relative to the risk it eliminates."
Memory trick
"Spoof the ARP, Poison the DNS, Twin the Wireless" — three attack types, each tied to the specific protocol or layer they abuse.