2.
1 – TCP/IP Protocol Vulnerabilities
These are weaknesses in the main protocols that run the internet and LANs. If we know the
weakness, we can secure it.
1) TCP (Transmission Control Protocol)
What TCP does (normal use):
• Creates reliable communication between two devices.
• Uses 3-way handshake:
1. SYN → 2. SYN-ACK → 3. ACK
• Guarantees delivery, correct order, and error checking.
Main vulnerabilities:
1. SYN Flood Attack
o Attacker sends lots of SYN packets to a server but never completes the
handshake.
o Server allocates resources (memory, connection table) for each half-open
connection.
o Result: server becomes overloaded and cannot respond to real users → DoS
(Denial of Service).
2. Session Hijacking
o Once TCP connection is established, attacker guesses or sniffs sequence
numbers.
o They inject their own packets into the session.
o Can impersonate a user, steal data, or send malicious commands.
Basic protections:
• SYN cookies, limiting half-open connections.
• Using encryption (e.g., TLS) so an attacker cannot see sequence numbers easily.
• Firewalls and IDS/IPS to detect abnormal connection patterns.
2) UDP (User Datagram Protocol)
What UDP does:
• Sends data without connection, no handshake.
• Fast but unreliable (no acknowledgement).
• Used in video streaming, VoIP, online games, DNS, etc.
Vulnerabilities:
1. UDP Flood
o Attacker sends a huge number of UDP packets to random ports.
o Target keeps checking “Do I have a service on this port?” and replies with
ICMP messages.
o CPU and bandwidth are consumed → DoS attack.
2. Amplification Attacks (e.g., DNS/SSDP/NTP amplification)
o Attacker sends small UDP request with spoofed source IP (victim’s IP).
o Server replies with a much larger response to the victim.
o Many such servers used together = very powerful DDoS.
Protection:
• Rate-limiting UDP traffic.
• Filtering spoofed IP addresses (ingress/egress filtering).
• Proper configuration of public UDP services.
3) HTTP (HyperText Transfer Protocol)
What HTTP does:
• Application-layer protocol used for web browsing.
• Works on port 80 (usually).
• Text-based, originally no encryption.
Vulnerabilities:
1. No Encryption (when not using HTTPS)
o Username, password, cookies, and all data can be read by anyone sniffing
the network.
o Enables Man-in-the-Middle (MITM) attacks.
2. Web Application Attacks (on top of HTTP)
o SQL Injection, XSS, CSRF, etc.
o These are not flaws in HTTP itself, but happen through HTTP requests.
Protection:
• Use HTTPS (HTTP over TLS/SSL) to encrypt traffic.
• Use secure coding for web apps, input validation, web application firewalls.
4) ARP (Address Resolution Protocol)
What ARP does:
• Works inside a local network (LAN).
• Maps IP address → MAC address.
• Example: “Who has IP [Link]? Tell [Link]”
Vulnerabilities:
1. No Authentication
o ARP accepts the last reply it sees and updates its table.
o There is no verification that the ARP reply is honest.
2. ARP Spoofing / ARP Poisoning
o Attacker sends fake ARP replies like:
▪ “[Link] is at MAC AA:AA:AA:AA:AA:AA” (attacker’s MAC)
o Victim’s traffic for the gateway now goes to attacker first.
o Attacker can:
▪ Sniff data
▪ Modify data
▪ Perform Man-in-the-Middle attack.
Protection:
• Use Static ARP entries in critical systems.
• Use Dynamic ARP Inspection on switches.
• Use encryption (HTTPS, SSH, VPN) so sniffed traffic is useless.
5) ICMP (Internet Control Message Protocol)
What ICMP does:
• Used for diagnostic and error messages.
• Example: ping, traceroute use ICMP.
Vulnerabilities:
1. ICMP Flood / Ping Flood
o Attacker sends many ICMP Echo Request packets.
o Target uses bandwidth and CPU to reply → DoS.
2. Smurf Attack (older but exam topic)
o Attacker sends ICMP requests to a broadcast address with victim’s IP as
source.
o All hosts in that network reply to the victim.
o Victim is flooded with ICMP replies.
3. Information Disclosure
o ICMP error messages can reveal network structure and live hosts.
Protection:
• Limit ICMP from internet on firewalls.
• Disable ICMP to broadcast.
• Rate-limit ping responses.
6) DHCP (Dynamic Host Configuration Protocol)
What DHCP does:
• Automatically gives IP address, subnet mask, gateway, DNS, etc. to clients.
Vulnerabilities:
1. DHCP Starvation
o Attacker sends many fake DHCP requests using different MAC addresses.
o DHCP pool becomes full → legitimate clients cannot get IP addresses.
2. Rogue DHCP Server
o Attacker runs their own DHCP server.
o When clients ask for IP, they might get:
▪ Wrong default gateway (attacker’s machine)
▪ Wrong DNS (redirecting traffic)
o Allows Man-in-the-Middle and traffic redirection.
Protection:
• Use DHCP snooping on switches.
• Limit which ports can send DHCP server replies.
• Monitor and block unauthorized DHCP servers.
7) DNS (Domain Name System)
What DNS does:
• Translates domain names ([Link]) into IP addresses (142.250.x.x).
• Very critical service.
Vulnerabilities:
1. DNS Spoofing / Cache Poisoning
o Attacker tricks DNS cache into storing fake IP for a domain.
o Users trying to visit [Link] get IP of attacker’s site.
o Used for phishing, stealing credentials.
2. DNS Tunneling
o Attacker hides data or commands inside DNS queries/responses.
o Bypasses firewalls because DNS is often allowed.
3. DNS Amplification
o As mentioned with UDP: small request → large response sent to victim.
Protection:
• Use DNSSEC (DNS Security Extensions) to sign DNS data.
• Secure and patch DNS servers.
• Use filtering and monitoring of DNS traffic.
2.2 – How Network Addresses Impact Network Security
Here we see how IP/MAC addresses, segmentation, and NAT affect security.
1) IPv4 and IPv6 Addresses
IPv4:
• 32-bit address, written like [Link].
• Limited addresses (~4.3 billion).
IPv6:
• 128-bit address, written like 2001:0db8::1.
• Very large address space.
Security impact:
• IP address identifies where a device is on the network.
• Access control often uses IP addresses (firewall rules).
• IPv6 supports IPsec as a standard feature, making end-to-end encryption easier.
• Big address space in IPv6 makes scanning the whole subnet harder for attackers.
2) MAC Addresses
What MAC is:
• 48-bit physical address of the network card.
• Written as AA:BB:CC:DD:EE:FF.
• Used on LAN only (Layer 2).
Security impact:
• Switches can secure ports using MAC address filtering or Port Security.
• But MAC can be spoofed (changed in software), so relying only on MAC is not
enough.
• Network access control (like 802.1X) can be stronger than simple MAC filtering.
3) Network Segmentation
What it is:
• Splitting one big network into many small parts (segments/subnets/VLANs).
• Example:
o VLAN 10 – Staff
o VLAN 20 – Students
o VLAN 30 – Servers
Security benefits:
• Limits broadcast traffic → better performance.
• Contains attacks:
o If malware infects one segment, it cannot automatically spread to others.
• Allows different security policies:
o Servers VLAN locked down strictly.
o Guest VLAN only allowed to internet, not internal resources.
Tools used:
• Routers, Layer 3 switches, VLANs, firewalls between segments.
4) CIDR Notation (Classless Inter-Domain Routing)
What CIDR is:
• A way to write subnet masks like /24, /22 instead of [Link] etc.
• /24 means: first 24 bits are network bits, rest 8 bits are host bits.
Security impact:
• Proper subnetting and CIDR can:
o Reduce broadcast domains.
o Group similar devices together.
o Apply different firewall rules per subnet.
• Example:
o [Link]/24 – Finance
o [Link]/24 – HR
Each subnet can have separate access controls.
5) NAT (Network Address Translation)
What NAT does:
• Translates private IPs (inside network) to a public IP (internet-facing).
• Most home routers use NAT.
Types (simple view):
• PAT (Port Address Translation) – Many devices share one public IP, different ports.
Security benefits:
• Internal devices are not directly visible on the internet.
• External attacker usually sees only the public IP of the router.
• Makes random scanning harder.
Limitations:
• NAT is not a full security solution; with misconfigurations (port forwarding) devices
can still be exposed.
6) Public vs. Private Networks
Private IP ranges (not routable on internet):
• [Link] – [Link]
• [Link] – [Link]
• [Link] – [Link]
Public IP:
• Unique globally; reachable over internet.
Security impact:
• Devices with public IPs are directly accessible and must be strongly protected
(firewalls, patches).
• Devices with private IPs are usually behind NAT/firewall, more protected.
• DMZ often uses public IPs, internal LAN uses private IPs.
2.3 – Network Infrastructure and Technologies
These are technologies and designs used to build and secure a modern network.
1) Network Security Architecture
What it means:
• The overall design of how you secure your network.
• Includes:
o Firewalls (perimeter and internal)
o IDS/IPS
o DMZs
o VPNs
o Segmentation / VLANs
o Access control policies
Goal:
• Ensure Confidentiality, Integrity, Availability (CIA) of data.
• Use defense in depth: multiple layers of security, so if one layer fails, others still
protect the network.
2) DMZ (Demilitarized Zone)
What DMZ is:
• A small, isolated network between the public internet and the internal LAN.
• Hosts public-facing servers:
o Web server
o Mail server
o Public DNS server
Why use DMZ:
• If an internet-facing server is hacked, the attacker is trapped in DMZ, not directly
inside internal LAN.
• Firewall rules:
o Internet ↔ DMZ (limited)
o DMZ ↔ Internal LAN (very limited, only necessary connections)
o Internet ↔ Internal LAN (strictly restricted or blocked)
3) Virtualization
What it is:
• Using software (like VMware, Hyper-V, VirtualBox) to run multiple virtual machines
(VMs) on one physical server.
• Each VM behaves like a separate computer.
Security points:
• Isolation: If one VM is infected, others are still safe (in theory).
• Easy to create test environments to analyze malware.
• However, if the hypervisor (the virtualization software) is compromised, all VMs
may be at risk.
4) Cloud
What cloud is:
• Using remote servers hosted by providers (AWS, Azure, GCP, etc.) to store data and
run applications.
Service models (basic idea):
• IaaS – Infrastructure as a Service (virtual machines, networks).
• PaaS – Platform as a Service (ready-made platform to deploy apps).
• SaaS – Software as a Service (applications like Gmail, Office 365).
Security aspects:
• Data stored outside your building; must be protected with:
o Encryption (at rest and in transit)
o Access control, strong authentication.
• Shared responsibility model:
o Cloud provider secures physical servers, underlying network.
o Customer secures their apps, data, and access control.
5) Honeypot
What honeypot is:
• A decoy system intentionally made to look vulnerable or interesting to attackers.
• Appears like a real server with valuable data.
Purpose:
• Attract attackers so:
o Real systems are safer.
o Security team can monitor attacker behavior.
o Gather information about new malware or techniques.
Security benefit:
• Helps in understanding and detecting threats.
• But it must be isolated so that attackers cannot use honeypot as a base to attack
others.
6) Proxy Server
What a proxy is:
• A server that sits between user and the internet.
• User → Proxy → Website (instead of user → Website directly).
Types:
• Forward Proxy – used inside companies; clients connect to proxy to access
internet.
• Reverse Proxy – placed in front of web servers to protect them.
Security benefits:
• Hides internal IP addresses.
• Can filter content (block certain websites, file types).
• Can enforce authentication (only authorized users can browse).
• Can cache web pages to improve speed.
7) IDS (Intrusion Detection System)
What IDS does:
• Monitors network traffic or host activity.
• Looks for signatures of known attacks or suspicious behavior.
• Types:
o NIDS – Network-based IDS (placed at network points).
o HIDS – Host-based IDS (installed on individual systems).
Key point:
• IDS detects and alerts, but does not block traffic by itself.
• Security team must take action after alert.
8) IPS (Intrusion Prevention System)
What IPS does:
• Similar to IDS but placed in-line with traffic (between source and destination).
• Can detect and automatically block malicious traffic:
o Drop packets
o Reset connections
o Change firewall rules
Difference IDS vs IPS (easy line):
• IDS = “Security camera” → sees and alerts.
• IPS = “Security guard” → sees, decides, and stops.