RANGER CompTIA Network+ (N10-009) · chapter 21 of 29
Week 21: Know your enemy
In this chapter Objectives 4.2
Objective 4.2
Attacks on availability and switches
DoS and DDoS
A denial-of-service (DoS) attack overwhelms a target so legit users can't reach it: floods of traffic or requests, or crashing a service. A distributed DoS (DDoS) comes from many sources at once, often a botnet of infected devices, so blocking one IP does not help. Impact: availability.
Exam tip Many sources = DDoS. Defenses: upstream/ISP scrubbing, CDN, rate limiting, redundancy.
VLAN hopping
VLAN hopping lets an attacker reach a VLAN they shouldn't. Two methods: switch spoofing (the attacker's device negotiates a trunk using DTP) and double tagging (two 802.1Q tags; the first switch strips the outer native-VLAN tag and forwards the inner one).
Exam tip Defenses: disable DTP/auto-trunking on access ports, set access ports to access mode, and use an unused native VLAN.
MAC flooding
A switch learns MAC addresses into its CAM / MAC address table. MAC flooding sends thousands of frames with fake source MACs until the table is full. The switch then floods unknown frames out every port, acting like a hub, so the attacker can sniff traffic.
Exam tip Defense: port security limiting MACs per port.
Objective 4.2
ARP and DNS attacks
ARP spoofing and ARP poisoning
ARP has no authentication. In ARP spoofing, the attacker sends forged ARP replies claiming 'I am the gateway's IP, here's my MAC.' The result, victims' ARP caches filled with the false mapping, is ARP poisoning. Traffic then flows through the attacker: an on-path attack.
Exam tip Telltale sign: two IPs (or the gateway's IP) mapped to the same MAC in arp -a. Defense: dynamic ARP inspection.
DNS spoofing and DNS poisoning
DNS spoofing sends a forged DNS answer so a victim goes to the wrong IP. DNS poisoning (cache poisoning) plants a false record in a resolver's cache, so EVERY client using that resolver is misdirected until the TTL expires.
Exam tip Defenses: DNSSEC validation, trusted resolvers, and encrypted DNS (DoH/DoT) to block tampering in transit.
Objective 4.2
Rogue gear, on-path, people, malware
Rogue devices and services
A rogue DHCP server hands out bad settings, such as itself as the gateway or DNS, sending traffic to the attacker or breaking connectivity. A rogue AP is an unauthorized access point plugged into the network, opening a back door around the firewall. Sometimes it's just an employee's home router.
Exam tip Defenses: DHCP snooping (only trusted ports may send DHCP offers), NAC, and wireless scans for unknown APs.
Evil twin
An evil twin is a rogue AP that copies a real SSID (like 'Kibble-Guest'), often with a stronger signal, so users connect to the attacker instead. The attacker can then capture logins or run on-path attacks.
Exam tip Rogue AP = unauthorized AP on your network. Evil twin = fake AP pretending to BE your network.
On-path attack
In an on-path attack (formerly man-in-the-middle), the attacker sits between two parties, reading or changing traffic. ARP poisoning, evil twins, rogue DHCP and DNS spoofing are all ways to get on-path.
Exam tip Encryption with certificate validation (TLS) blocks most on-path snooping.
Social engineering
Attacking people instead of machines:
- Phishing: fake emails or messages that trick users into clicking or giving credentials
- Dumpster diving: searching trash for passwords, diagrams, old configs
- Shoulder surfing: watching someone type a password or PIN
- Tailgating: following an authorized person through a secure door
Exam tip Defenses: training, shredding, privacy screens, mantraps/access control vestibules, and a culture of challenging strangers.
Malware
Malware is malicious software: viruses, worms (self-spreading across the network), trojans, ransomware (encrypts data for ransom), spyware, botnets. Network impact: outages, data theft, traffic floods, DDoS from inside.
Exam tip A worm spreads with no user action, so segmentation and patching limit it.
Check yourself 1Wired PCs on the warehouse VLAN suddenly have 10.30.0.66 as their default gateway and DNS, and the real gateway is 10.30.0.1. What attack fits best?
- MAC flooding
- Rogue DHCP server
- VLAN hopping
- Evil twin access point
Show the answer
Answer: B. Rogue DHCP server
A rogue DHCP server hands out its own address as gateway and DNS, redirecting traffic.
Practice questions
Answer in your head, then open the answer. Ranger's Packet Trail has 483 questions like these for Network+, with mock exams.
Question 1Thousands of compromised home routers flood a company's website with traffic from many countries at once. What is this attack?
- Evil twin
- MAC flooding
- DoS
- DDoS
Show the answer
Answer: D. DDoS
A distributed denial-of-service comes from many sources, often a botnet, which makes it hard to block by source address.
Question 2An attacker sends small DNS queries with the victim's IP spoofed as the source to many open resolvers, which send much larger responses to the victim. What is this?
- DNS cache poisoning of the resolvers
- VLAN hopping by double tagging
- A reflected amplification DDoS
- An on-path attack using spoofing
Show the answer
Answer: C. A reflected amplification DDoS
Reflection uses third-party servers to send traffic to a spoofed victim; amplification makes each response much larger than the request.
Question 3A switch suddenly starts sending all traffic out every port after a laptop sends thousands of frames with random source MAC addresses. Based on the exhibit, which attack is this?
- DNS spoofing
- VLAN hopping
- ARP poisoning
- MAC flooding
Show the answer
Answer: D. MAC flooding
MAC flooding fills the switch's CAM (MAC address) table. With no room for real entries, the switch floods frames like a hub, letting the attacker sniff traffic.
Question 4An attacker connected to an access port configured with Cisco's default dynamic trunking negotiates a trunk with the switch and can now send traffic into every VLAN. What is this?
- VLAN hopping by switch spoofing
- MAC flooding of the CAM table
- VLAN hopping by double tagging
- ARP spoofing of the gateway address
Show the answer
Answer: A. VLAN hopping by switch spoofing
Switch spoofing abuses trunk negotiation (DTP) to form a trunk. Prevent it by setting access ports to access mode and disabling negotiation.
Question 5An attacker in VLAN 1, which is also the trunk's native VLAN, sends frames with two 802.1Q tags: the outer for VLAN 1 and the inner for VLAN 50. What attack is this, and what mitigates it?
- Double tagging; use an unused VLAN as the native VLAN
- ARP poisoning; enable DHCP snooping on access ports
- Switch spoofing; enable port security on access ports
- MAC flooding; enable BPDU guard on the trunk ports
Show the answer
Answer: A. Double tagging; use an unused VLAN as the native VLAN
In double tagging the first switch strips the native-VLAN outer tag and the next switch reads the inner tag. Using an unused native VLAN (or tagging the native VLAN) stops it.
CompTIA, A+, Network+, Security+ and Linux+ are trademarks of CompTIA, Inc. Ranger Gamez is not affiliated with or endorsed by CompTIA. The practice questions are written to the published exam objectives; they are not real exam questions.