[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 3 · 3.1.a
AP Cybersecurity · Securing Networks
Common Network Attacks
Three of them poison a lookup table. The fourth just floods. Ask which table is lying.
key ideaThree of these attack a lookup table. The fourth just floods. Ask which table is lying.
The categories
Networks run on translation: names to addresses, addresses to hardware. Poison a translation and traffic goes to the wrong place while everything still appears to work — which is what makes these attacks hard to notice.
The first three redirect or expose traffic; only the smurf attack is about availability. Identify the layer being lied to and the attack names itself.| Attack | What is corrupted | Mechanism | Result |
|---|
| ARP poisoning | the IP–MAC table on the gateway | falsified ARP responses | traffic for another host arrives at the adversary |
| MAC flooding | the switch's address table | many frames, each with a different MAC | the switch enters broadcast mode; every frame is visible |
| DNS poisoning | a DNS record on a resolver | posing as an authoritative name server | the browser is sent to a malicious site that steals credentials |
| smurf attack | nothing — it overwhelms | floods the network with ICMP requests | denial of service: resources unavailable to authorized users |
Read the second column first. An attack that corrupts a table is silent; an attack that floods is loud — and they need completely different detection.
ARPAddress Resolution Protocol — how a gateway builds a table pairing IP addresses with MAC addresses.
MAC addressThe hardware identifier of a network interface. Switches use it to decide which port a frame belongs on.
Broadcast modeWhat a switch falls back to when its table overflows — it sends every frame everywhere, which is exactly what an eavesdropper wants.
DNSDomain Name System — the lookup from a name to an IP address.
ICMPThe protocol behind ping. Harmless individually; a flood of it is a denial of service.
Denial of serviceAn attack that makes a system or resource unavailable to authorized users.
Telling them apart
the deciding symptom
- Is the network unusable? → smurf, or another denial of service.
- Is traffic reaching the wrong host on the local network? → ARP poisoning.
- Is everything suddenly visible to every port? → MAC flooding forced broadcast mode.
- Does the right name reach the wrong site? → DNS poisoning.
Worked examples
EX 1
Traffic arriving at the wrong machine
On a small LAN, a workstation begins receiving traffic addressed to the file server. The file server is still online. Name the attack.
1
Note what still works
Both hosts are up, so this is not a denial of service.
2
Identify the misdirection
Traffic for one IP is arriving at a different MAC.
3
Name the table
The gateway's IP–MAC table — built by ARP.
4
Name the attack
ARP poisoning: falsified ARP responses pair the server's IP with the adversary's MAC.
5
State the impact
The adversary sits in the middle of the conversation and can read or alter it.
EX 2
Everyone can see everything
A switch that normally forwards frames only to the correct port starts sending every frame to every port. Nothing is offline. Explain.
1
Recall how a switch decides
It consults its MAC address table to pick a port.
2
Ask what happens when that table is full
It falls back to broadcast mode — send everywhere.
3
Name the cause
MAC flooding: many Ethernet frames, each with a different MAC, until the table overflows.
4
State the adversary's gain
They can now collect all the frames on the network from a single port.
5
Give the control
Port security on the switch, limiting how many MAC addresses one port may present.
EX 3
The right name, the wrong site
Users type the correct bank address and reach a convincing page that harvests logins. Their devices are clean. What happened?
1
Rule out the endpoint
The devices are clean, so the deception is upstream.
2
Identify the translation
Name → IP — that is DNS.
3
Name the attack
DNS poisoning: an adversary posing as an authoritative name server plants a fake record on a resolver.
4
State the impact
Browser traffic is redirected to a malicious site designed to steal credentials.
5
Note the reach
Everyone using that resolver is affected — one poisoned record, many victims.
Watch out
ARP and DNS poison different tables
ARP maps IP to MAC on the local network; DNS maps name to IP across the internet. Naming the wrong one describes a different attack entirely.
MAC flooding is an eavesdropping attack
It looks like a flood, but the goal is to force broadcast mode so every frame becomes visible. Nothing goes offline.
A smurf attack corrupts nothing
It is a denial of service using an ICMP flood. If the question describes users unable to reach resources, this is the family.
Silence is the norm for the first three
Poisoning attacks are designed to keep the network working. ‘Everything seems fine’ is not evidence that nothing is wrong.