6.4Attacks and countermeasures

For a network operator, the ability to correctly diagnose the type of attack from an observed anomaly (a sudden traffic spike, abnormal DNS responses, suspicious traffic within the LAN) and select the appropriate countermeasure is at the heart of incident and fault response. This section builds the understanding of how representative attack techniques work, together with the reasoning pattern for tracing from an observed event to its cause and then to a countermeasure.

6.4.1DoS/DDoS attacks

• A DoS attack aims to make a target service unavailable. A DDoS attack launches the attack simultaneously from many distributed compromised hosts (a botnet, etc.), so because the sources are spread out, simple IP-address blocking is not enough to stop it.
• A SYN Flood attack sends a flood of TCP SYN packets in the three-way handshake without ever completing the connection with an ACK. The server exhausts its half-open connection tracking table, becoming unable to process legitimate connection requests. A countermeasure is SYN cookies, which embed connection information in a cryptographically generated sequence number instead of storing it server-side.
• A reflection attack sends requests with the source IP address spoofed to the victim's IP address to many intermediary servers (DNS servers, etc.), concentrating the responses onto the victim. When the abused protocol's response is larger than the request (DNS, NTP, etc.), this becomes an amplification attack, generating large attack traffic from a small amount of sent traffic.

6.4.2DNS cache poisoning and ARP spoofing

• DNS cache poisoning injects a forged name-resolution result into a caching DNS server, redirecting users to a fake site. It typically works by getting a forged response to arrive before the legitimate authoritative DNS server's response. A countermeasure is DNSSEC, which attaches a digital signature to DNS responses so their validity can be verified.
• ARP spoofing is when an attacker sends forged ARP replies (mapping an IP address to the attacker's own MAC address) onto the LAN, poisoning other hosts' ARP caches. This causes traffic meant for the legitimate gateway to route through the attacker's device, enabling a man-in-the-middle attack (eavesdropping or tampering with the traffic). A countermeasure is DHCP snooping (paired with Dynamic ARP Inspection), where the switch records the IP-MAC mappings legitimately assigned via DHCP and discards any ARP reply that does not match.

6.4.3Port scanning and zero trust/SASE

• Port scanning is a reconnaissance technique that sequentially probes each port on a target host to enumerate open ports (running services). It is often used as a preliminary step to find vulnerable services before an attack; effective countermeasures include closing unnecessary ports and detecting scans with an IDS.
• Sender domain authentication (SPF, DKIM, DMARC) verifies the legitimacy of an email's sending domain to prevent spoofed (phishing) email. SPF verifies the sending IP address via DNS, DKIM verifies via a digital signature, and DMARC declares a policy for how to handle mail based on the SPF/DKIM verification results.
• Zero trust is the approach of never assuming "it's safe because it's the internal network," instead verifying every access attempt each time. SASE (Secure Access Service Edge) is an architecture that integrates SD-WAN with security functions (zero-trust access, WAF, FW, etc.) delivered from the cloud, uniformly protecting access from sites and from outside the office.

Suppose a network operator faces a surge of connection requests to a public web server, with legitimate users reporting they "cannot reach the site." Monitoring logs show a flood of SYN packets with almost no connections ever completing with an ACK. From this, you diagnose a SYN Flood attack exhausting the half-open connection table, and consider countermeasures such as enabling SYN cookies on the server/load balancer, or blocking abnormal SYN traffic via an upstream IPS/DDoS mitigation service. In a separate incident, several internal devices report "a certificate error on what should be a legitimate site" or "being redirected to an unfamiliar site." This strongly suggests a forged DNS response, so you suspect DNS cache poisoning, clear the caching DNS server's cache, and consider deploying DNSSEC as a permanent fix. Further, within the internal LAN, one specific device experiences abnormally slow communication, and a packet capture reveals traffic going to a MAC address that differs from the legitimate default gateway. This is a sign of a man-in-the-middle attack via ARP spoofing—you diagnose that an attacker's device is likely relaying and eavesdropping on the traffic, isolate the device from the network, and as a permanent countermeasure configure DHCP snooping (with Dynamic ARP Inspection) on the switch to block forged ARP replies. Narrowing down the attack type uniquely from the characteristics of the observed symptom (half-open connections, abnormal name resolution, or an anomalous MAC address on the LAN) and choosing the countermeasure accordingly is the practice of incident response.

6.4.4Section summary

• SYN Flood targets exhaustion of half-open connections; reflection/amplification attacks abuse source-IP spoofing and response size
• DNS cache poisoning injects a forged name-resolution result; ARP spoofing uses fake ARP replies to enable a man-in-the-middle attack
• Countermeasures include DNSSEC, DHCP snooping, and sender domain authentication; migrating to zero trust/SASE, which assume no trusted perimeter, is also an option