2.1Vulnerabilities of TCP/IP protocols

TCP/IP is the foundation of the world's communication, but many of its protocols were built to "just work" first, with security bolted on later. As a result, mechanisms that trust the other party without verification remain throughout. Attackers exploit this "trusting" nature to hijack traffic, plant false information, or overwhelm services. This section covers the weaknesses of the familiar protocols ARP, DNS, DHCP, ICMP, TCP, and HTTP, and the representative attacks that abuse them, through the lens of telling "which attack a packet or symptom is a sign of." Rather than deeply analyzing each attack, the introductory goal is simply to be able to match a name to its characteristics and identify it.

2.1.1Attacks that hijack traffic: ARP spoofing and DNS poisoning

• ARP spoofing (ARP poisoning) forges the mapping between an IP address and a MAC address within one LAN. When an attacker sends forged ARP replies claiming "the owner of that IP is me (my MAC)," the victim's traffic starts flowing through the attacker, enabling a MITM (man-in-the-middle) attack that can read and tamper with the traffic. ARP's weakness is that it has no way to verify the sender.
• DNS poisoning (DNS spoofing / cache poisoning) forges the mapping between a name and an IP address. When DNS is made to believe a false answer, a user who types the correct domain name is redirected to the IP of a fake site prepared by the attacker. The user "types the right URL yet lands on a fake site," which leads to phishing and data theft.
• The two are similar in "forging a mapping table" but operate at different layers: ARP spoofing is L2 (IP-to-MAC within one LAN), while DNS poisoning is at the application layer (name-to-IP). Both essentially make the victim believe a wrong destination and redirect them.

2.1.2Attacks on resources and services: DHCP, ICMP, and TCP SYN

• DHCP starvation floods the DHCP server with forged requests to exhaust its pool of assignable IP addresses so that legitimate devices cannot obtain one. Additionally, standing up a rogue DHCP server can hand out a fake gateway or DNS to redirect traffic to the attacker.
• ICMP is the diagnostic protocol used by ping and the like. Abused, it serves reconnaissance (scanning) to find live hosts and paths, or an ICMP flood that overwhelms a link with a mass of ICMP. Handy for diagnostics, yet an unrestricted outward path makes it a tool for attacks.
• A TCP SYN flood is a DoS that exploits a weakness in the TCP three-way handshake. The attacker sends a mass of connection requests (SYN) without returning the acknowledgment (ACK), filling up the server's slots of "half-open connections." As a result, legitimate users can no longer establish new connections.

Suppose an employee reports: "When I tried to log in to our usual internal portal, it looked identical but the browser threw a certificate warning. It felt off, so I checked." What introductory-level support needs to do here is first guess the attack from the symptom. The sign that "I typed the correct address yet seem to land on a different site" is a classic indication of DNS poisoning, where the name-to-IP mapping is forged. On the other hand, if several PCs on the same LAN suddenly slow down and the network device's ARP table shows an unnatural state where "one MAC address holds many IPs," you suspect a MITM via ARP spoofing. Likewise, if just one internal server is in a state where "no new connections can be established at all" and its logs are full of half-open SYNs, that is a TCP SYN flood; if a mass of pings saturates the link, that is an ICMP flood—you keep translating observed phenomena into attack names. At the CCST introductory level, you need not go as far as advanced forensics to stop the attack. What matters is being able to identify the attack by "which protocol's trust or capacity is being abused" and point to a basic defensive direction—for example, moving eavesdroppable plaintext HTTP traffic to HTTPS. Being able to name it correctly first is the starting point for the follow-up response (reporting to the owner, blocking, and permanent countermeasures).

2.1.3Section summary

• ARP spoofing is a MITM that forges IP-to-MAC in one LAN; DNS poisoning forges name-to-IP to redirect to a fake site—both "forge a mapping table"
• DHCP is abused via starvation/rogue servers, ICMP via reconnaissance/floods, and TCP via SYN floods—link each protocol's weakness to its attack name
• Plaintext HTTP can be eavesdropped and tampered with, so encrypt it with HTTPS—the introductory goal is to identify attacks from symptoms