Common attacks

Knowing how networks are attacked is how you defend them. Most attacks use one of a few ideas, and each has a well-known defence.

Eavesdropping (sniffing) is reading traffic as it passes, easy on open Wi-Fi or with plain protocols like HTTP, FTP and Telnet. The defence is encryption: HTTPS, SSH, VPNs, and WPA2 or WPA3 on Wi-Fi.

Spoofing is lying about who you are: a fake source IP address, a fake MAC address, or a fake ARP reply saying "I'm the router". ARP spoofing lets an attacker on the same LAN sit between you and the gateway, a man-in-the-middle, reading and changing traffic. DNS spoofing gives you a false address for a name. Defences: switches that check ARP and DHCP messages, DNSSEC, and above all TLS, because a fake server can't show a valid certificate for the real name.

A denial of service (DoS) attack floods a server or link with so much traffic or so many requests that real users can't get through. A distributed DoS (DDoS) uses thousands of hijacked devices at once, often cheap cameras and routers that still have default passwords. Defences: providers that absorb and filter huge floods, rate limits, and not leaving devices on default passwords so they can't be recruited.

Phishing attacks people instead of the network: a convincing email or text links to a fake login page. Network tools help (filters, warnings about new domains), but the strongest defences are checking the address before logging in, a password manager (which won't fill in a password on the wrong site) and two-factor sign-in, ideally with passkeys or security keys that can't be phished.