CompTIA Network+ Preparation · lesson 21 of 30 · 25 min
Denial of Service (DoS) and DDoS Attacks
A DoS (Denial of Service) attack floods a target with traffic or exploits a vulnerability to make it unavailable to legitimate users. A DDoS (Distributed DoS) uses thousands of compromised systems (a botnet) to amplify the attack.
Volumetric attacks — overwhelm bandwidth (UDP flood, ICMP flood). Measured in Gbps.
Protocol attacks — exploit protocol weaknesses (SYN flood — sends TCP SYN packets without completing the handshake, exhausting the server’s connection table).
Application layer attacks — target specific applications (HTTP GET flood, Slowloris — opens many connections and sends partial requests slowly).
Amplification attacks — attacker sends small requests to open servers (DNS, NTP, SSDP) with a spoofed source IP (the victim’s IP). Servers send large responses to the victim. DNS amplification can achieve 50–70× amplification.
Mitigation: rate limiting, blackhole routing, scrubbing centers, SYN cookies, ingress filtering (BCP38 — ISPs block spoofed source IPs).
Man-in-the-Middle (MITM) Attacks
In a MITM attack, the attacker secretly intercepts and potentially modifies communications between two parties who believe they are communicating directly.
ARP Poisoning (ARP Spoofing) — attacker sends gratuitous ARP replies associating their MAC address with a legitimate IP (e.g., the default gateway). Victims update their ARP cache and send traffic to the attacker. Mitigation: Dynamic ARP Inspection (DAI), static ARP entries.
SSL Stripping — attacker downgrades HTTPS to HTTP, intercepting plaintext traffic. Mitigation: HSTS (HTTP Strict Transport Security).
BGP Hijacking — attacker announces more specific routes to redirect internet traffic. Mitigation: RPKI (Resource Public Key Infrastructure).
DNS Spoofing (Cache Poisoning) — attacker injects false DNS records into a resolver’s cache, redirecting users to malicious sites. Mitigation: DNSSEC.
VLAN Hopping
VLAN hopping allows an attacker on one VLAN to send traffic to another VLAN without going through a router.
Switch Spoofing — attacker configures their NIC to negotiate a trunk link (using DTP — Dynamic Trunking Protocol). Once trunking, they can send tagged frames to any VLAN. Mitigation: disable DTP on access ports (switchport nonegotiate), explicitly set access mode.
Double Tagging — attacker sends a frame with two 802.1Q tags. The outer tag matches the native VLAN (stripped by the first switch); the inner tag carries the target VLAN (forwarded by the second switch). Only works toward the victim (one-way). Mitigation: change the native VLAN to an unused VLAN, tag the native VLAN.
Other Network Attacks
MAC Flooding — floods the switch with fake MAC addresses, filling the CAM table. Switch enters fail-open mode and broadcasts all frames (like a hub), allowing the attacker to capture traffic. Mitigation: port security.
Rogue DHCP Server — attacker runs a DHCP server that assigns their IP as the default gateway, routing all traffic through them. Mitigation: DHCP snooping.
IP Spoofing — attacker forges the source IP address to impersonate another host or bypass IP-based access controls.
Replay Attack — attacker captures valid authentication data and retransmits it later. Mitigation: timestamps, nonces, sequence numbers.
On-path attack — the current CompTIA term for MITM — the attacker is “on the path” between communicating parties.
Attack Mitigation Summary
ARP poisoning → DAI | MAC flooding → port security | Rogue DHCP → DHCP snooping | VLAN hopping → disable DTP, change native VLAN | DoS → rate limiting, SYN cookies | DNS spoofing → DNSSEC
Key Terms
Key Terms
Knowledge Check — 12 Questions
Network Security — Attacks
A SYN flood attack exploits which protocol?
- UDP
- ICMP
- TCP three-way handshake
- ARP
Answer: TCP three-way handshake
SYN flood sends SYN packets without completing the handshake — the server allocates resources for half-open connections until exhausted.
ARP poisoning is mitigated by which switch feature?
- Port security
- DHCP snooping
- Dynamic ARP Inspection (DAI)
- VLAN tagging
Answer: Dynamic ARP Inspection (DAI)
DAI validates ARP packets against the DHCP snooping binding table, dropping packets with invalid MAC-IP mappings.
MAC flooding causes a switch to:
- Shut down all ports
- Broadcast all frames (fail-open mode)
- Drop all unknown frames
- Enable port security automatically
- Answer: Broadcast all frames (fail-open mode)
When the CAM table is full, the switch cannot learn new MACs and broadcasts frames to all ports — like a hub. VLAN hopping via switch spoofing is prevented by:
- Enabling DTP on all ports
- Disabling DTP and setting ports to access mode explicitly
- Using the default native VLAN
- Enabling DHCP snooping
- Answer: Disabling DTP and setting ports to access mode explicitly
switchport mode access + switchport nonegotiate prevents DTP negotiation, blocking switch spoofing attacks. DNS cache poisoning is mitigated by:
- DHCP snooping
- DNSSEC
- DAI
- Port security
- Answer: DNSSEC
DNSSEC (DNS Security Extensions) digitally signs DNS records, allowing resolvers to verify authenticity. In a DNS amplification attack, the attacker spoofs the source IP as:
- The DNS server’s IP
- The victim’s IP
- The attacker’s real IP
- The router’s IP
- Answer: The victim’s IP
The attacker sends small DNS queries with the victim’s IP as source — the DNS server sends large responses to the victim. A rogue DHCP server attack is mitigated by:
- DAI
- Port security
- DHCP snooping
- VLAN tagging
- Answer: DHCP snooping
DHCP snooping marks only trusted ports as valid DHCP server sources — untrusted ports cannot send DHCP Offer/Ack.
Double-tagging VLAN hopping is a two-way attack — the attacker can both send and receive traffic from the target VLAN.
- True
- False
Answer: False
Double-tagging is one-way only — the attacker can send frames to the target VLAN but cannot receive responses.
SSL stripping downgrades HTTPS to HTTP. Which defense prevents this?
- DNSSEC
- HSTS (HTTP Strict Transport Security)
- DAI
- Port security
Answer: HSTS (HTTP Strict Transport Security)
HSTS instructs browsers to always use HTTPS for a domain — preventing SSL stripping by refusing HTTP connections.
CompTIA Network+ uses the term “on-path attack” to describe what was previously called:
- DoS attack
- Replay attack
- Man-in-the-Middle (MITM)
- Amplification attack
- Answer: Man-in-the-Middle (MITM)
CompTIA updated terminology — “on-path attack” replaces “man-in-the-middle” to describe an attacker intercepting communications.
Which attack uses a botnet to overwhelm a target with traffic from thousands of sources?
- DoS
- DDoS
- Replay
- Spoofing
Answer: DDoS
DDoS (Distributed DoS) uses many compromised systems (botnet) simultaneously — much harder to block than single-source DoS.
A replay attack is mitigated by including which element in authentication messages?
- Encryption
- Timestamps or nonces
- Digital signatures only
- MAC addresses
Answer: Timestamps or nonces
Timestamps and nonces (one-time random values) ensure captured authentication data cannot be reused — each message is unique.
Previous lesson: Network performance optimization: QoS, traffic shaping, bandwidth management
Back to CompTIA Network+ Preparation
Next lesson: Network hardening: ACLs, port security, 802.1X, NAC, firewall rules, VPNs