Network-Based Attacks: DoS, DDoS, Man-in-the-Middle, and Replay Attacks

Network-Based Attacks: DoS, DDoS, Man-in-the-Middle, and Replay Attacks

Understanding how network-based attacks work at the packet level is a core skill for any cybersecurity professional. This lesson covers four attack types that appear on the CompTIA Security+, CompTIA CySA+, and ISC2 CC exams and that you will encounter in real defensive work.

Denial-of-Service (DoS) Attacks

A denial-of-service (DoS) attack sends so much traffic or so many requests to a target system that it can no longer serve legitimate users. The attacker uses a single source. The most common technique is the SYN flood.

In a normal TCP handshake, the client sends a SYN packet, the server replies with SYN-ACK and reserves memory for the connection, and the client completes the handshake with an ACK. In a SYN flood, the attacker sends thousands of SYN packets with spoofed or unreachable source addresses. The server sends SYN-ACKs and waits for ACKs that never arrive. Its connection table fills up, and it refuses new legitimate connections.

Traffic characteristics to recognize in Wireshark:

• An abnormally high volume of SYN packets from one or a small number of sources
• No corresponding ACK packets completing the handshakes
• The SYN flag is set; the ACK flag is not set in the initial packets
• Destination port is typically a well-known service port (e.g., port 80 or 443)

Countermeasures: SYN cookies allow the server to avoid reserving memory until the handshake completes. Rate limiting and firewall rules can drop excessive SYN packets from a single source. Ingress filtering blocks packets with obviously spoofed source addresses.

Distributed Denial-of-Service (DDoS) Attacks

A DDoS attack scales the DoS concept by using many compromised machines — a botnet — controlled by a command-and-control (C2) server. The attacker (bot herder) sends instructions to the C2, which relays commands to thousands of bots (infected endpoints). All bots flood the target simultaneously, making the attack volume far larger and the source harder to block.

A volumetric DDoS may use amplification reflectors — publicly reachable servers (such as open DNS resolvers or NTP servers) that respond to a small spoofed request with a much larger reply directed at the victim. This multiplies the traffic without increasing botnet size.

Botnet architecture components:

1. Attacker / bot herder

2. C2 server

3. Bots (compromised endpoints)

4. Amplification reflectors (in amplification attacks)

5. Target

Countermeasures: Cloud-based DDoS scrubbing services absorb volumetric traffic upstream. ISP-level blackhole routing drops attack traffic before it reaches the target network. Disabling or rate-limiting open recursive DNS and NTP servers reduces amplification potential.

Man-in-the-Middle (MitM) Attacks

In a man-in-the-middle attack, an adversary secretly positions themselves between two communicating parties, intercepting and potentially altering traffic. Neither party realizes a third party is present.

ARP Poisoning is a common LAN-layer technique. ARP (Address Resolution Protocol) maps IP addresses to MAC addresses on a local network. ARP has no authentication. An attacker broadcasts fake ARP replies telling other hosts that the attacker's MAC address corresponds to the gateway's IP address. Victim machines update their ARP cache with the false mapping and send traffic to the attacker instead of the real gateway. The attacker forwards traffic onward so communication continues — victims notice nothing.

What to look for in a .pcap file:

• Gratuitous ARP replies not triggered by a request
• Two different MAC addresses claiming the same IP address
• A sudden change in the MAC address associated with the gateway IP in ARP traffic
• The attacker's MAC appears as the source in ARP replies

Countermeasures: Dynamic ARP Inspection (DAI) on managed switches validates ARP packets against a DHCP snooping binding table and drops invalid ARP replies. Static ARP entries for critical hosts prevent ARP cache poisoning. Encrypting traffic with TLS limits the value of intercepted data even if MitM succeeds.

Replay Attacks

A replay attack captures valid authentication data — such as a session token, a Kerberos ticket, or a hashed credential — transmitted over a network, then retransmits it later to impersonate the legitimate user. The attacker does not need to decrypt the data; they simply reuse it.

Example scenario: An attacker captures a valid session cookie from an unencrypted HTTP session. Hours later, they inject that cookie into their own HTTP request and the server accepts it as if the original user were present.

Countermeasures: Using timestamps and short expiration windows in authentication tokens means a replayed token is rejected once it expires. Nonces (numbers used once) embedded in authentication exchanges ensure each authentication is unique. TLS encryption prevents the attacker from capturing usable tokens in the first place. Mutual authentication verifies both ends of the connection.

Lab Safety and Responsible Use

All packet capture and attack simulation work in this course is performed only on isolated lab virtual machines and closed lab networks. Never run packet captures, flood tools, or ARP spoofing tools on any production network, public network, or network you do not own and have explicit authorization to test. Unauthorized interception of network traffic may violate federal law under the Electronic Communications Privacy Act and similar statutes. Always confirm the lab environment is properly isolated before beginning any exercise. Follow your instructor's directions exactly.

Connecting to Exam Domains

These attack types are tested across CompTIA Security+ (Threats, Attacks, and Vulnerabilities domain), CompTIA CySA+ (Threat and Vulnerability Management), and ISC2 CC (Network Security). Being able to recognize attack traffic in a packet capture and recommend a matching countermeasure is a skill tested in scenario-based exam questions.