Security
Attack Reference
Common network attacks — definitions, indicators, and mitigations
| Attack | Description | Indicators | Mitigation |
|---|---|---|---|
| DoS / DDoS | Overwhelms target with traffic or requests | Service unavailability, high CPU/bandwidth | Rate limiting, IPS, traffic scrubbing, ACLs |
| VLAN Hopping | Exploits DTP to trunk or double-tags frames | Unauthorized VLAN access | Disable DTP (nonegotiate), set native VLAN, prune |
| MAC Flooding | Floods switch MAC table to force broadcast mode | Traffic sniffing | Port security, MAC limit, storm control |
| ARP Spoofing | Sends fake ARP replies to intercept traffic | On-path attacks, data theft | Dynamic ARP Inspection (DAI), static ARP |
| DNS Poisoning | Injects false DNS records | Redirects to malicious sites | DNSSEC, secure DNS servers |
| Rogue DHCP | Unauthorized DHCP server gives bad config | Traffic interception, DoS | DHCP Snooping, trusted ports |
| Evil Twin | Fake AP mimics legitimate wireless network | Credential theft | 802.1X, WPA3, wireless IDS |
| On-Path (MITM) | Intercepts communications between two parties | Data theft, session hijack | Encryption (TLS), certificate pinning |
| Phishing | Social engineering via email/web | Credential theft, malware | User training, email filtering, MFA |
| Brute Force | Automated password guessing | Account compromise | Account lockout, MFA, strong passwords |
| MAC Spoofing | Changes device MAC to bypass controls | Unauthorized access | 802.1X, port security (sticky) |