Network Attacks, Adversaries, and Reading Baseline Traffic

3.1.AAttack

Five Network Attacks to Recognize

Network attacks exploit the trust built into core protocols — ARP, DNS, Ethernet switching — that were never designed with an adversary in mind.

🌐 Network Attack Classifier — click each type

An adversary sends falsified ARP packets to the default gateway, linking the target's IP address to the adversary's MAC address. Traffic meant for the target routes to the adversary instead — a textbook on-path (man-in-the-middle) attack.

🔑ARP poisoning is the go-to example of an on-path (man-in-the-middle) attack — both victims believe they're talking directly to each other, but every message actually passes through the adversary first, who can read, copy, or alter it before passing it along.

3.1.BConcept

How Adversaries Actually Get Onto a Network

Beyond the named attacks above, several structural weaknesses make networks vulnerable in the first place:

Weakness	What it enables
Missing or misconfigured firewalls	Malicious traffic can flood the network, map its structure, or spoof a device
Compromised device on the LAN	Adversary leverages existing access to compromise other devices nearby
Open, unsecured data ports	Physically plugging in grants LAN access, enabling DoS or MAC attacks
Unsecured wireless signals	Adversaries outside the building can eavesdrop or attack the wireless network
No device/user authentication	Adversaries can join the network directly to attack from within
Open network port	A rogue access point plugged in bypasses firewalls entirely

2.1.BConcept

Adversary Types, Grounded in Real Traffic

You met these back in Unit 1 as a discussion topic. Now, with real packet captures in front of you, they're a lot less abstract — a script kiddie running a downloaded ARP-spoofing tool leaves very different traces than a transnational criminal organization running a coordinated DDoS.

🕵️ Adversary Types, Revisited

Motivation: Clout / experimentation

Low-skilled, uses pre-made tools without deep technical knowledge.

2.1.CConcept

The Attack Lifecycle in Packet Data

This six-phase model (aligned with the industry-standard MITRE ATT&CK framework) is the same one from Unit 1 — but a Wireshark capture is exactly the kind of evidence that lets you place a real event into one of these phases.

🧬 The Attack Lifecycle, Revisited

Gathering information about a target — often using open source intelligence (OSINT).

Concept

Reading Baseline Traffic in Wireshark

A baseline is simply a recorded picture of what normal traffic looks like on a given network — which protocols show up, roughly how often, and from which devices. Without a baseline, "unusual" has no reference point.

ExampleGuided Example — Spotting the Anomaly

A captured baseline shows one ARP reply per device roughly every few minutes, consistent with normal network housekeeping. Later in the same capture, you see this: 14:02:03 ARP reply: 192.168.1.1 is-at AA:BB:CC:DD:EE:01 14:02:04 ARP reply: 192.168.1.1 is-at AA:BB:CC:DD:EE:99 14:02:04 ARP reply: 192.168.1.1 is-at AA:BB:CC:DD:EE:99 14:02:05 ARP reply: 192.168.1.1 is-at AA:BB:CC:DD:EE:99

Step 1 — Compare to baseline

The baseline showed one ARP reply per device every few minutes. This burst shows multiple replies within two seconds — already a deviation worth investigating.

← Back to Activity 2.1.2 Next: Activity 4.2.4 →Establishing Identity in Cyberspace.