1. Learning Objectives

By the end of this lesson, you will be able to:

• Explain common network attacks and their objectives.
• Understand ARP, DNS, and IP spoofing.
• Explain MAC flooding and its impact on network switches.
• Understand DHCP starvation and rogue DHCP attacks.
• Differentiate DoS and DDoS attacks.
• Explain SYN flood attacks and TCP connection establishment.
• Understand Man-in-the-Middle (MitM) attacks.
• Explain session hijacking concepts and prevention.
• Understand network reconnaissance and its phases.
• Identify indicators of suspicious network activity.
• Understand how firewalls, IDS, IPS, segmentation, and monitoring reduce risk.
• Prepare a basic network attack detection and response report.

2. Introduction to Network Attacks

A network attack is an attempt to compromise the confidentiality, integrity, or availability of systems and data communicated over a network.

Attackers may try to:

• Intercept communication.
• Impersonate legitimate devices.
• Redirect users to malicious destinations.
• Steal authentication information.
• Disrupt network availability.
• Discover exposed systems and services.
• Gain unauthorized access.
• Move between systems inside an organization.

Real-world example

Imagine an organization with:

• 100 employee computers.
• One internal file server.
• One database server.
• One firewall.
• Multiple switches.
• A wireless network.
• An internet connection.

An attacker who gains access to an employee network might attempt to discover other systems, impersonate network devices, intercept poorly protected traffic, or disrupt services.

The organization's security team must identify suspicious activity before it causes serious damage.

3. Understanding the Attack Surface

An attack surface is the collection of systems, services, interfaces, accounts, and communication paths that could potentially be targeted.

Common network attack surfaces include:

• Public-facing servers.
• Exposed network ports.
• Wireless access points.
• Remote-access services.
• DNS infrastructure.
• DHCP infrastructure.
• Network switches and routers.
• Internal file-sharing services.
• VPN gateways.
• Unpatched network devices.

Why Is Attack Surface Important?

The more unnecessary services and access paths an organization exposes, the more opportunities an attacker may have.

Example:

A database server should accept connections only from approved application servers.

If it is accessible from every employee device and the public internet, its attack surface is unnecessarily large.

Attack Surface Reduction

• Disable unnecessary services.
• Restrict network access.
• Apply security patches.
• Use network segmentation.
• Enforce strong authentication.
• Monitor network traffic.
• Maintain an accurate asset inventory.

4. ARP Spoofing

4.1 What Is ARP?

ARP stands for Address Resolution Protocol.

It is used in IPv4 local networks to map an IP address to a MAC address.

Example:

A computer wants to communicate with:

192.168.1.20

But Ethernet communication on the local network requires a destination MAC address.

The computer uses ARP to discover the MAC address associated with that IPv4 address.

Normal ARP Process

1. Computer A needs to communicate with Computer B.
2. Computer A checks its ARP cache.
3. If no valid mapping exists, it broadcasts an ARP request.
4. Computer B replies with its MAC address.
5. Computer A stores the mapping temporarily.
6. Communication proceeds using the discovered MAC address.

4.2 What Is ARP Spoofing?

ARP spoofing is an attack in which a malicious device sends forged ARP messages to associate its MAC address with another device's IP address.

For example:

In an ARP spoofing scenario, the attacker attempts to make the employee computer believe that the gateway's IP address belongs to the attacker's MAC address.

Traffic may then be sent to the wrong device.

4.3 What Can Happen?

Depending on network configuration and attacker position, ARP spoofing may support:

• Traffic interception.
• Man-in-the-Middle attacks.
• Traffic disruption.
• Session exposure where applications are poorly protected.
• Redirection attempts.

ARP spoofing does not automatically reveal encrypted HTTPS content.

4.4 ARP Spoofing Detection

Security teams can monitor:

• Unexpected changes in IP-to-MAC mappings.
• Multiple MAC addresses claiming the same IP.
• Unusual ARP reply patterns.
• Gateway MAC address changes.
• Unexpected ARP traffic bursts.

4.5 ARP Spoofing Prevention

• Enable Dynamic ARP Inspection (DAI) on supported switches.
• Use DHCP snooping to build trusted IP-to-MAC bindings.
• Apply network segmentation.
• Secure switch ports.
• Use static ARP entries only where operationally appropriate.
• Monitor ARP table changes.
• Protect sensitive applications with TLS.

Important: ARP is used for IPv4. IPv6 uses Neighbor Discovery Protocol (NDP), which has its own security considerations.

5. DNS Spoofing and DNS Poisoning

5.1 What Is DNS?

DNS stands for Domain Name System.

It translates domain names into IP addresses.

Example:

www.example.com

may resolve to an IP address such as:

203.0.113.10

The example IP belongs to a documentation-only address range and is not a real production destination.

DNS helps users access services without remembering IP addresses.

5.2 What Is DNS Spoofing?

DNS spoofing involves providing false DNS information so that a user or system connects to an unintended destination.

Example:

An employee enters a familiar banking domain.

A manipulated DNS response directs the employee to an attacker-controlled destination instead of the legitimate service.

If the user does not notice the deception, the user may disclose sensitive information.

5.3 DNS Spoofing vs DNS Cache Poisoning

DNS spoofing is a broad term for falsifying DNS-related information.

DNS cache poisoning is a technique where false DNS records are inserted into a DNS resolver's cache.

A poisoned cache may cause multiple users to receive an incorrect response until the entry expires or is removed.

5.4 DNS Security Risks

• Users redirected to malicious websites.
• Phishing opportunities.
• Malware distribution.
• Unauthorized redirection of applications.
• Service disruption.
• Manipulation of internal service discovery.

5.5 DNS Detection and Prevention

• Use trusted DNS resolvers.
• Enable DNSSEC validation where supported.
• Monitor unusual DNS responses.
• Restrict unauthorized DNS server changes.
• Use secure DNS transport where appropriate.
• Monitor suspicious domains and DNS patterns.
• Apply endpoint protection and web filtering.
• Investigate unexpected DNS configuration changes.

What Is DNSSEC?

DNS Security Extensions add cryptographic authentication to DNS data.

DNSSEC helps a validating resolver verify that DNS records have not been altered and that the data is authentic within the DNSSEC chain of trust.

Important: DNSSEC does not encrypt DNS queries and does not automatically prevent users from visiting malicious domains that legitimately exist in DNS.

6. IP Spoofing

6.1 What Is an IP Address?

An IP address identifies a network interface for communication at the IP layer.

For example:

192.168.1.10

IP addresses help routers forward packets toward their destinations.

6.2 What Is IP Spoofing?

IP spoofing occurs when an attacker creates IP packets containing a forged source IP address.

The source address in the packet does not necessarily identify the actual sender.

Example

A packet may contain:

• Source IP: 192.168.1.100
• Destination IP: 192.168.1.200

But the packet may have originated from a different system.

Why Do Attackers Spoof IP Addresses?

Common objectives include:

• Hiding the true source of traffic.
• Impersonating a trusted source.
• Supporting certain denial-of-service attacks.
• Evading simplistic IP-based trust controls.
• Creating misleading network logs.

6.3 IP Spoofing Limitations

IP spoofing does not automatically allow an attacker to receive replies sent to the forged address.

It is especially difficult to complete ordinary two-way communication when the attacker cannot receive the responses.

6.4 IP Spoofing Detection and Prevention

• Apply ingress and egress filtering.
• Use anti-spoofing rules on network boundaries.
• Validate expected source address ranges.
• Monitor unusual traffic patterns.
• Use stateful firewall controls.
• Avoid relying only on source IP for authentication.
• Use cryptographic authentication for sensitive services.

Key concept: IP addresses are useful network identifiers, but they are not proof of user or device identity.

7. MAC Flooding

7.1 What Is a Network Switch?

A network switch connects devices inside a local network.

It learns which MAC addresses are reachable through each switch port.

It stores this information in a MAC address table, also known as a CAM table.

Example:

When the switch receives a frame, it uses the destination MAC address to determine where the frame should be forwarded.

7.2 What Is MAC Flooding?

MAC flooding is an attack that attempts to overwhelm a switch's MAC address table with a large number of artificial MAC address entries.

If a switch cannot learn or maintain entries correctly, its forwarding behavior may change.

Depending on the switch and configuration, unknown unicast traffic may be flooded within the relevant VLAN.

Possible Impact

• Increased traffic exposure within a VLAN.
• Network performance degradation.
• Greater opportunity for traffic observation on an affected segment.
• Operational disruption.

Important: Modern enterprise switches commonly have protections and resource controls. MAC flooding does not guarantee that all traffic becomes visible to an attacker.

7.3 Detection

Monitor:

• Sudden increases in learned MAC addresses.
• Unexpected MAC address changes.
• MAC addresses moving repeatedly between ports.
• Switch port-security violations.
• Unusual broadcast and unknown-unicast traffic.

7.4 Prevention

• Enable switch port security.
• Limit learned MAC addresses per access port.
• Use 802.1X network access control.
• Disable unused switch ports.
• Use VLAN segmentation.
• Monitor switch logs.
• Apply suitable rate limits where supported.

8. DHCP Starvation and Rogue DHCP

8.1 What Is DHCP?

DHCP stands for Dynamic Host Configuration Protocol.

It automatically provides network configuration to clients.

Typical information includes:

• IP address.
• Subnet mask.
• Default gateway.
• DNS server.
• Lease duration.

8.2 DHCP DORA Process

DHCP commonly uses a four-step process called DORA.

Step 1 – Discover

The client broadcasts a DHCP Discover message.

Step 2 – Offer

A DHCP server offers an available IP address.

Step 3 – Request

The client requests the offered address.

Step 4 – Acknowledge

The server confirms the lease.

8.3 What Is DHCP Starvation?

DHCP starvation is an attack that attempts to consume the available DHCP address pool.

The attacker may generate many DHCP requests using different client identifiers or MAC addresses.

If the available address pool becomes exhausted, legitimate devices may not receive addresses.

Possible Impact

• New devices cannot connect normally.
• Users may lose network access.
• DHCP allocation becomes unreliable.
• Business services may be disrupted.

8.4 What Is a Rogue DHCP Server?

A rogue DHCP server is an unauthorized device that provides DHCP configuration to clients.

It may offer incorrect:

• Default gateway.
• DNS server.
• Network settings.

A malicious or misconfigured DHCP server may redirect traffic or disrupt communication.

8.5 Detection

Look for:

• Multiple unexpected DHCP servers.
• Unexpected DHCP Offer messages.
• DHCP pool exhaustion.
• Sudden increases in DHCP requests.
• Clients receiving unfamiliar gateways or DNS servers.

8.6 Prevention

• Enable DHCP snooping on supported switches.
• Mark trusted DHCP server-facing ports appropriately.
• Apply DHCP rate limiting.
• Monitor address pool utilization.
• Restrict unauthorized network devices.
• Use network access control.
• Maintain DHCP server logs.

DHCP snooping helps switches distinguish trusted DHCP server traffic from unauthorized DHCP responses.

9. Denial of Service (DoS)

9.1 What Is DoS?

A Denial-of-Service attack attempts to make a system, service, or network unavailable to legitimate users.

The attacker may overwhelm resources or exploit a weakness that prevents normal operation.

Common Targets

• Websites.
• Application servers.
• DNS services.
• Network gateways.
• Authentication systems.
• APIs.
• Network infrastructure.

Common DoS Categories

Volumetric attacks

Attempt to consume available network bandwidth.

Protocol attacks

Exploit the behavior or resource requirements of network protocols.

Application-layer attacks

Target application functions and consume processing or connection resources.

9.2 What Is DDoS?

DDoS stands for Distributed Denial of Service.

Instead of one source, a large number of systems generate traffic toward the target.

These systems may be compromised devices or other distributed traffic sources.

DoS vs DDoS

9.3 Business Impact

A successful DoS or DDoS incident can cause:

• Website downtime.
• Lost revenue.
• Customer dissatisfaction.
• Operational disruption.
• Increased infrastructure costs.
• Damage to business reputation.

9.4 Detection Indicators

• Sudden traffic spikes.
• Large numbers of requests.
• Abnormal connection rates.
• Unusual geographic traffic distribution.
• High bandwidth utilization.
• Increased CPU and memory usage.
• Increased server response times.
• Repeated service timeouts.

9.5 DDoS Defense

• Use upstream DDoS protection.
• Deploy rate limiting.
• Use traffic filtering.
• Apply load balancing.
• Use CDN and web application protection where appropriate.
• Monitor network baselines.
• Coordinate with the ISP.
• Prepare an incident response plan.

10. SYN Flood Attack

10.1 Understand the TCP Three-Way Handshake

TCP establishes a connection using a three-step process.

Step 1 – SYN

The client sends a SYN packet to request a connection.

Step 2 – SYN-ACK

The server responds with SYN-ACK.

Step 3 – ACK

The client sends ACK to complete the handshake.

A TCP connection is then established.

10.2 What Is a SYN Flood?

A SYN flood is a denial-of-service technique that sends large numbers of connection requests without completing the expected handshake.

The server may maintain resources for incomplete connections.

If resources become exhausted, legitimate users may experience connection failures.

Example

A web server normally handles thousands of legitimate connections.

An unusual volume of incomplete connection attempts may consume connection-tracking or other server resources.

Detection

Monitor:

• High SYN packet rates.
• Abnormal SYN-to-ACK ratios.
• Large numbers of half-open connections.
• Unusual connection timeouts.
• Increased connection queue utilization.

Prevention

• Enable SYN cookies where supported.
• Apply appropriate connection limits.
• Use firewalls and DDoS protection.
• Tune operating system network settings carefully.
• Monitor TCP connection states.
• Use upstream mitigation when needed.

Important: SYN traffic alone does not prove an attack. Legitimate network failures and traffic bursts can also produce unusual handshake patterns.

11. Man-in-the-Middle (MitM) Attacks

11.1 What Is a MitM Attack?

A Man-in-the-Middle attack occurs when an attacker positions themselves between two communicating parties and attempts to observe, alter, or relay their communication without proper authorization.

Normal Communication

Employee → Application Server

The employee communicates directly with the legitimate server.

MitM Scenario

Employee → Attacker-controlled intermediary → Application Server

The attacker attempts to intercept or manipulate communication.

11.2 Common MitM Techniques

MitM can involve multiple techniques, including:

• ARP spoofing.
• DNS manipulation.
• Rogue wireless access points.
• Malicious proxies.
• Compromised network infrastructure.
• Certificate validation failures.
• Session token theft.

Example: Public Wi-Fi Risk

An employee connects to an untrusted Wi-Fi network.

If the network is malicious or compromised, an attacker may attempt to:

• Redirect traffic.
• Present fake login pages.
• Intercept unencrypted communication.
• Manipulate DNS responses.
• Exploit weak application security.

11.3 What Can an Attacker See?

It depends on the protocol and security controls.

With unencrypted HTTP, communication content may be exposed.

With correctly configured HTTPS, an intermediary generally cannot read or silently modify the protected application content without defeating or bypassing the TLS security protections.

An attacker may still observe some connection metadata, such as IP addresses and traffic timing.

11.4 MitM Prevention

• Use HTTPS everywhere.
• Validate TLS certificates.
• Avoid ignoring certificate warnings.
• Use secure Wi-Fi authentication.
• Avoid untrusted network access for sensitive administration.
• Use VPNs where appropriate.
• Apply network segmentation.
• Use MFA.
• Protect DNS infrastructure.
• Monitor unusual gateway and ARP changes.

Important: A VPN does not automatically protect a compromised endpoint or make every application secure.

12. Session Hijacking Concepts

12.1 What Is a Session?

A session is a mechanism that allows an application to maintain a user's authenticated state across multiple requests.

For example:

1. A user signs in to an application.
2. The server authenticates the user.
3. The application creates a session.
4. The browser receives a session cookie or token.
5. The browser includes the session identifier in later requests.
6. The server recognizes the authenticated session.

12.2 What Is Session Hijacking?

Session hijacking occurs when an attacker obtains or abuses a valid session identifier or authentication token to impersonate a legitimate user.

Common Risk Factors

• Insecure HTTP communication.
• Exposed session tokens.
• Cross-site scripting vulnerabilities.
• Malware on user devices.
• Poor session management.
• Weak token storage.
• Missing session expiration controls.

12.3 Example

A user signs in to a company portal.

The portal issues a session cookie.

If an attacker obtains that valid cookie through a separate vulnerability, the attacker may attempt to use it to impersonate the user.

This is why session tokens must be treated like sensitive credentials.

12.4 Session Protection

Use appropriate cookie attributes:

Secure

The browser sends the cookie only over secure HTTPS connections.

HttpOnly

Client-side JavaScript cannot directly access the cookie.

SameSite

Helps control when cookies are included in cross-site requests.

Also implement:

• Session expiration.
• Session rotation after authentication.
• Logout invalidation.
• Reauthentication for sensitive actions.
• MFA.
• Protection against XSS and CSRF.
• Monitoring for suspicious session activity.

13. Network Reconnaissance

13.1 What Is Reconnaissance?

Reconnaissance is the process of gathering information about a target environment.

In cybersecurity, reconnaissance may be performed by both defenders and attackers.

Defenders use it to understand their own assets and exposure.

Attackers may use it to identify potential targets and weaknesses.

13.2 Types of Reconnaissance

Passive reconnaissance

Information is collected without directly interacting with the target systems.

Examples:

• Public DNS information.
• Public company websites.
• Publicly available documentation.
• Public certificate information.
• Published IP ownership information.

Active reconnaissance

The tester directly interacts with systems to gather information.

Examples:

• Authorized host discovery.
• Authorized port discovery.
• Service identification.
• Network path inspection.
• Configuration review.

Passive vs Active Reconnaissance

13.3 Common Reconnaissance Information

A security assessor may document:

• IP address ranges.
• Domain names.
• DNS records.
• Network devices.
• Open services.
• Software versions.
• Exposed management interfaces.
• Network segmentation.
• Remote-access gateways.
• Public-facing applications.

13.4 Why Reconnaissance Matters

It helps an organization answer:

• Which systems are exposed?
• Which services are reachable?
• Which systems are outdated?
• Which network segments are accessible?
• Are administrative services unnecessarily exposed?
• Are unexpected devices connected?

13.5 Defensive Reconnaissance

Organizations should conduct authorized asset discovery regularly.

Maintain:

• An asset inventory.
• Approved IP ranges.
• Service ownership records.
• Network diagrams.
• Exposure reports.
• Vulnerability management records.

14. Intrusion Detection Systems (IDS)

14.1 What Is IDS?

IDS stands for Intrusion Detection System.

It monitors systems or network traffic and identifies activity that may indicate malicious behavior.

An IDS primarily detects and alerts. It does not necessarily block the activity.

Types of IDS

NIDS – Network-based IDS

Monitors network traffic at selected network locations.

HIDS – Host-based IDS

Monitors activity on an individual system.

Examples of host activity include:

• File changes.
• Process activity.
• System logs.
• Authentication events.
• Configuration modifications.

14.2 IDS Detection Methods

Signature-based detection

Looks for known patterns associated with malicious activity.

Advantages:

• Effective for recognized threats.
• Can provide specific alerts.

Limitations:

• May miss new or modified attacks.
• Depends on current signatures.

Anomaly-based detection

Identifies deviations from expected behavior.

Examples:

• Unusual network traffic volume.
• Unexpected device communication.
• Unusual login patterns.
• Abnormal DNS queries.

Advantages:

• Can identify previously unknown patterns.

Limitations:

• May generate false positives.
• Requires useful baselines and tuning.

Hybrid detection

Combines signatures, anomaly detection, and contextual information.

14.3 Example IDS Alerts

An alert is an investigation starting point, not automatic proof of compromise.

15. Intrusion Prevention Systems (IPS)

15.1 What Is IPS?

IPS stands for Intrusion Prevention System.

An IPS monitors traffic and can take action against traffic identified as malicious.

Possible actions include:

• Dropping packets.
• Blocking connections.
• Resetting sessions.
• Applying temporary blocks.
• Triggering security events.

IDS vs IPS

15.2 IDS and IPS Deployment

An organization may deploy:

• NIDS sensors near network boundaries.
• IPS at selected network gateways.
• Host-based monitoring on critical servers.
• Centralized alert management through a SIEM.

15.3 IDS/IPS Limitations

• Encrypted traffic may limit inspection visibility.
• Incorrect rules may generate false positives.
• Misconfiguration can block legitimate traffic.
• Attackers may use techniques that evade signatures.
• Sensors may not see traffic outside their observation points.

IDS and IPS should be part of a layered security architecture, not the only security controls.

16. Network Detection and Response Controls

A strong security strategy uses multiple defensive controls.

Defense in Depth

Defense in depth means using multiple security controls so that the failure of one control does not automatically compromise the entire organization.

Example:

1. Firewall restricts external access.
2. IDS detects suspicious traffic.
3. IPS blocks selected malicious activity.
4. Network segmentation limits lateral movement.
5. EDR detects endpoint compromise.
6. SIEM correlates events.
7. Incident response teams investigate and contain threats.

17. Understanding Network Attack Indicators

Security teams must distinguish suspicious behavior from normal network activity.

18. Security Monitoring: What Should a SOC Analyst Check?

A SOC analyst should investigate more than a single alert.

Useful investigation data includes:

Network Information

• Source IP.
• Destination IP.
• Source port.
• Destination port.
• Protocol.
• Packet count.
• Connection duration.
• Traffic volume.

Endpoint Information

• Hostname.
• User account.
• Process name.
• Parent process.
• Device status.
• Endpoint security alerts.

Identity Information

• Authentication failures.
• Successful logins.
• MFA events.
• Unusual login locations.
• Privileged account activity.

Contextual Information

• Is the destination a known business service?
• Is the traffic expected for that device?
• Did the behavior begin recently?
• Is the same activity happening across multiple systems?
• Does the alert match other security events?

19. Practical Lab 1: Understand ARP Behavior

Objective: Inspect your own device's ARP table.

Windows

arp -a

Linux

ip neigh

macOS

arp -a

Tasks

1. Record the gateway IP address.
2. Identify its MAC address.
3. Identify other learned local devices.
4. Record the entries.
5. Repeat the inspection after normal network activity.
6. Compare changes and explain which changes are expected.

Questions

• What does an ARP cache contain?
• Why does a gateway have a MAC address?
• Why can an IP-to-MAC mapping change?
• What might an unexpected gateway MAC change indicate?

Expected outcome: Understand how normal ARP resolution works and what suspicious changes might look like.

20. Practical Lab 2: Inspect DHCP Configuration

Objective: Review the network configuration received from DHCP.

Windows

ipconfig /all

Linux

ip route

resolvectl status

macOS

networksetup -getinfo Wi-Fi

The macOS interface name may differ depending on the device.

Record

• IPv4 address.
• Subnet mask or prefix.
• Default gateway.
• DNS servers.
• DHCP server, where displayed.
• Lease information, where available.

Tasks

1. Identify the configured DHCP server.
2. Record the DNS server addresses.
3. Compare the gateway with the expected network configuration.
4. Identify any unexpected configuration.
5. Explain how a rogue DHCP server could affect these values.

Expected outcome: Understand how DHCP configuration affects client connectivity and security.

21. Practical Lab 3: Analyze a Simulated Network Attack Log

Objective: Identify suspicious activity from a fictional log.

Scenario

A company's monitoring system records the following events:

Your Tasks

For each event:

1. Identify the possible attack.
2. Identify the affected network component.
3. Identify the evidence needed to confirm the suspicion.
4. Recommend an immediate defensive action.
5. Identify which logs should be preserved.

Example Analysis

Expected outcome: Learn to correlate events rather than treating every alert independently.

22. Practical Lab 4: TCP Connection and Traffic Analysis

Objective: Understand normal TCP connection behavior.

Use your own local development environment or authorized lab.

Task A: Inspect Network Connections

Windows:

Get-NetTCPConnection

Linux:

ss -ant

macOS:

netstat -an

Task B: Identify TCP States

Common states include:

• LISTEN.
• SYN-SENT.
• SYN-RECEIVED.
• ESTABLISHED.
• FIN-WAIT.
• TIME-WAIT.
• CLOSE-WAIT.

Questions

1. What does LISTEN indicate?
2. What does ESTABLISHED indicate?
3. What does TIME-WAIT mean?
4. Why might a server have many SYN-RECEIVED connections?
5. Why should unusual connection patterns be compared with normal baselines?

Expected outcome: Understand TCP connection states and recognize patterns worth investigating.

23. Practical Lab 5: IDS Alert Investigation

Objective: Practice interpreting fictional IDS alerts.

Simulated Alerts

ALERT 001
Event: Possible ARP spoofing
Source: 192.168.10.50
Observation: Gateway IP mapped to an unexpected MAC address

ALERT 002
Event: Possible SYN flood
Destination: 192.168.10.20
Observation: Unusual increase in incomplete TCP connections

ALERT 003
Event: Possible rogue DHCP
Observation: Unexpected DHCP Offer from an unauthorized device

ALERT 004
Event: Suspicious DNS activity
Observation: Multiple unusual DNS responses for an internal client

Your Tasks

For every alert, document:

• Alert identifier.
• Suspected attack.
• Affected asset.
• Evidence required.
• Severity.
• Immediate containment action.
• Recovery recommendation.

Important Investigation Principle

Do not automatically block a system based only on one alert.

Validate the evidence, check business context, and follow the organization's incident response procedures.

24. Practical Lab 6: Build a Network Defense Plan

Objective: Design defensive controls for a fictional company.

Organization

The company has:

• Employee network.
• Guest Wi-Fi.
• Internal file server.
• Database server.
• Public web application.
• Network management systems.
• Security monitoring server.

Your Tasks

1. Divide the environment into security zones.
2. Identify critical assets.
3. Define permitted network communication.
4. Select appropriate firewall controls.
5. Identify where IDS and IPS sensors should be placed.
6. Define ARP and DHCP protections.
7. Define DNS monitoring requirements.
8. Establish network traffic baselines.
9. Define incident escalation procedures.
10. Prepare a security architecture diagram.

Example Control Plan

Expected Deliverable

A short network defense plan containing:

• Network diagram.
• Asset inventory.
• Threat list.
• Security controls.
• Monitoring requirements.
• Incident response actions.

25. Incident Response: What Should a Security Team Do?

When a possible network attack is detected, the security team should follow a structured process.

Step 1 – Identification

• Review alerts.
• Identify affected devices.
• Validate evidence.
• Determine possible attack type.

Step 2 – Analysis

• Review network logs.
• Check endpoint events.
• Correlate timestamps.
• Identify the scope of activity.
• Estimate business impact.

Step 3 – Containment

Depending on the incident:

• Isolate affected endpoints.
• Block malicious traffic.
• Disable unauthorized services.
• Restrict affected network segments.
• Coordinate with infrastructure teams.

Step 4 – Eradication

• Remove unauthorized configurations.
• Remove malicious software.
• Fix exploited vulnerabilities.
• Rotate exposed credentials.
• Patch affected systems.

Step 5 – Recovery

• Restore normal service.
• Validate system integrity.
• Monitor for recurring activity.
• Confirm that security controls are functioning.

Step 6 – Lessons Learned

• Document the incident.
• Identify control failures.
• Improve monitoring.
• Update incident response procedures.
• Record preventive actions.

Important: Preserve relevant evidence and follow organizational procedures before making changes that could destroy forensic information.

27. Lesson Summary

In this lesson, you learned:

• ARP spoofing manipulates IP-to-MAC mappings.
• DNS spoofing can redirect users to unintended destinations.
• IP spoofing forges packet source addresses.
• MAC flooding targets switch MAC address-table capacity.
• DHCP starvation attempts to exhaust address pools.
• Rogue DHCP servers provide unauthorized network configuration.
• DoS attacks target service availability.
• DDoS attacks use distributed traffic sources.
• SYN floods exploit incomplete TCP connection handling.
• MitM attacks attempt to intercept or manipulate communication.
• Session hijacking abuses valid authentication sessions.
• Reconnaissance identifies systems and exposed services.
• IDS detects suspicious activity.
• IPS can block selected malicious traffic.
• Network segmentation and monitoring reduce attack impact.
• Incident response requires identification, analysis, containment, eradication, recovery, and lessons learned.

28. Key Terms to Remember

29. Coming Next: Network Monitoring and Packet Analysis

In the next lesson, you will learn how security professionals observe network communication and investigate suspicious traffic.

Topics include:

• Packet analysis fundamentals.
• Traffic baselines.
• Wireshark fundamentals.
• Capture filters and display filters.
• TCP handshake analysis.
• DNS packet analysis.
• HTTP and TLS metadata.
• Network logs.
• NetFlow and IPFIX.
• Identifying unusual traffic patterns.
• Practical network traffic investigation.

CYNARKS Academy – Learn to Understand. Practice to Defend.

Practice networking and security testing only on systems you own or have explicit authorization to test.