Network Security

How Networks Work

These terms describe how a packet gets from one program to another:

Packet: A chunk of data with a header giving its source and destination.
Frame: The link layer’s unit of data, sent between devices on one local network.
MAC address: A 48-bit identifier for a network interface on its local network.
IP address: An identifier for a host across networks.
Prefix: A block of IP addresses sharing the same leading bits, such as 128.6.0.0/16.
Private address: An address used inside a home or organization and never routed across the Internet.
Loopback address: The address 127.0.0.1, which always means the computer itself.
Local network: Devices that can send frames directly to one another through a switch or access point.
Switch: A device that learns which MAC address is on each port and forwards frames accordingly.
Broadcast domain: The set of devices that a frame sent to the broadcast address reaches.
Router: A device that connects a local network to other networks.
Default gateway: The router a host sends packets to for destinations outside its own network.
DHCP (Dynamic Host Configuration Protocol): The protocol a host uses to obtain an IP address, gateway, and DNS server.
ARP (Address Resolution Protocol): The protocol that maps an IPv4 address to a MAC address on the local network.
Gratuitous ARP: An unrequested ARP announcement of a device’s own address mapping.
Link layer: The layer that moves frames between devices on one local network.
Network layer: The layer that moves packets between hosts across networks, defined by IP.
Transport layer: The layer that delivers data to the right program on a host.
Application layer: The protocol the programs themselves speak, such as HTTP or DNS.
Port number: A transport-layer number identifying the program a packet is for.
TCP (Transmission Control Protocol): A transport protocol providing a reliable, ordered stream of bytes over a connection.
UDP (User Datagram Protocol): A transport protocol that sends individual messages without a connection or ordering.
Sequence number: The number TCP assigns to each byte so the receiver can order and acknowledge data.
DNS (Domain Name System): The distributed database that translates names into addresses.
Resolver: A server that performs name lookups on behalf of hosts and caches the results.
BGP (Border Gateway Protocol): The protocol autonomous systems use to exchange routes.
End-to-end principle: Application-specific functions such as reliability and security belong in the hosts, not the network core.

Attacks on the Local Network

These terms describe attacks that need a position on the victim’s network and the switch features that stop them:

Content addressable memory (CAM): Memory searched by content, used by a switch to map a MAC address to a port in one step.
CAM table overflow: Flooding a switch with invented source addresses until its CAM table fills and it copies frames to every port.
Port security: A switch setting limiting how many, or which, MAC addresses a port may use.
Managed switch: A switch that an administrator can configure.
ARP cache poisoning: Sending forged ARP replies so a victim’s traffic goes through the attacker. Also called ARP spoofing.
Dynamic ARP Inspection (DAI): A switch feature that drops ARP replies not matching known address bindings.
Static ARP entry: A fixed IP-to-MAC mapping that ARP replies cannot overwrite.
Neighbor Discovery Protocol (NDP): IPv6’s replacement for ARP, which trusts local messages the same way.
DHCP spoofing: Running a rogue DHCP server to supply a victim’s gateway or DNS server.
Rogue DHCP server: An unauthorized server that responds to DHCP requests with the attacker’s configuration.
DHCP starvation: Requesting leases for invented addresses until the real server has none left.
DHCP snooping: A switch feature that drops DHCP server replies from untrusted ports and records leases.
Binding table: The switch’s record of which IP address, MAC address, and port go together.
VLAN (virtual LAN): A logical network sharing physical switches with other VLANs.
Trunk: A link between switches carrying tagged frames from several VLANs.
Native VLAN: The VLAN whose frames travel over a trunk without a tag.
VLAN hopping: Getting frames into a VLAN that was supposed to be isolated from the attacker’s.
Switch spoofing: Negotiating a trunk link from an end device to receive other VLANs’ traffic.
Double tagging: Sending a frame with two VLAN tags so the second switch delivers it into another VLAN.
Evil twin: An attacker’s access point broadcasting the name of a legitimate Wi-Fi network.

Spoofing and Routing

These terms describe forged addresses and the routing system between networks:

On-path attacker: An attacker positioned where the victim’s packets pass and able to see and alter them.
Off-path attacker: An attacker elsewhere on the Internet who can send packets but not see the victim’s.
IP spoofing: Writing a false source address into a packet.
Ingress filtering: Dropping packets leaving a network whose source address does not belong to it.
Autonomous system (AS): A set of prefixes and routers under one administration, with a unique number.
AS path: The list of autonomous systems a route announcement has passed through.
Most specific prefix: The matching route with the longest prefix length, which a router prefers.
BGP hijack: An unauthorized announcement of someone else’s addresses.
More specific prefix: A smaller block inside a victim’s prefix, announced so routers prefer it.
Route leak: Passing on routes learned from one provider or peer to another, usually by mistake.
Prefix filter: A list of the prefixes a neighbor is allowed to announce.
RPKI (Resource Public Key Infrastructure): Signed statements of which AS may announce each prefix.
ROA (Route Origin Authorization): A signed statement that one AS may announce a prefix up to a given length.
Route Origin Validation: Comparing a BGP announcement with published ROAs.
Invalid route: An announcement that contradicts an ROA covering its prefix.
BGPsec: A BGP extension in which each AS signs an announcement as it forwards it.

Transport Layer Attacks

These terms describe attacks on TCP connections and the fixes for them:

Three-way handshake: The SYN, SYN-ACK, and ACK exchange that opens a TCP connection.
Initial sequence number: The randomly chosen number where a side’s byte numbering starts.
Receive window: The range of sequence numbers a TCP receiver will currently accept.
Sequence number prediction: Guessing a server’s initial sequence numbers to forge a connection from a trusted host.
SYN flood: Filling a server’s table of pending connections with SYN segments that are never completed.
SYN cookie: Encoding a pending connection in the SYN-ACK’s sequence number instead of storing it.
TCP reset: A segment with the RST flag that tells the receiver to abandon the connection.

DNS

These terms describe name resolution and the attacks on it:

Zone: A part of the name space served by its own set of name servers.
Delegation: Handing a part of a zone to another set of servers.
Root servers: The servers that know which servers handle each top-level domain.
Top-level domain servers: The servers for edu, com, and the rest, which know each domain’s name servers.
Authoritative name server: A server that holds a domain’s records.
Registrar: A company accredited to register names in a top-level domain.
Recursive resolver: A server that performs a full lookup on a host’s behalf and caches the results.
Time to live (TTL): The number of seconds a resolver may cache a record.
A record: A DNS record mapping a name to an IPv4 address.
NS record: A DNS record naming a zone’s authoritative servers.
MX record: A DNS record naming the servers that accept a domain’s email.
Transaction ID: The 16-bit number a resolver uses to match a reply to its query.
Pharming: Sending a user who typed the correct name to a server the attacker runs.
Hosts file: A local file consulted before DNS that overrides lookups for the names it lists.
Registry lock: A service under which the registry will not change a domain’s name servers without out-of-band confirmation.
Cache poisoning: Planting a forged record in a resolver’s cache. Also called DNS spoofing.
Kaminsky attack: Poisoning a whole domain by forging referrals in replies to lookups of nonexistent names.
Referral: A reply that names the servers for a zone instead of responding to the query.
Source port randomization: Sending each DNS query from a random port so forged replies must guess it.
DNSSEC (DNS Security Extensions): Digital signatures on DNS records that let a resolver verify them.
Trust anchor: The root zone’s public key, shipped with resolver software.
Bogus: A DNSSEC reply whose signatures are missing, expired, or wrong, which the resolver rejects.
DNS rebinding: Switching a name’s address after a page loads so its script can reach private devices.
Same-origin policy: The browser rule that keeps a script from reading responses from other sites.
Lame delegation: NS records pointing to servers that no longer serve the zone.
Sitting Ducks: Hijacking a domain by claiming its lame delegation at a DNS hosting provider.
DNS over TLS (DoT): DNS carried over a TLS connection on its own port.
DNS over HTTPS (DoH): DNS queries sent as HTTPS requests.

Denial of Service

These terms describe attacks on availability and the defenses against them:

Denial-of-service (DoS) attack: Making a system unavailable to the people who are supposed to use it.
Distributed denial-of-service (DDoS) attack: A denial-of-service attack whose traffic comes from many sources at once.
Ping of death: A 1990s attack that crashed systems with an oversized reassembled packet.
Reflection attack: Sending spoofed requests so that public servers reply to the victim.
Smurf attack: Pinging a network’s broadcast address with the victim’s source address.
Amplification attack: A reflection attack using a service whose reply is much larger than the request.
Amplification factor: The size of a reply divided by the size of the request that produced it.
Botnet: Compromised devices running malware that an attacker directs from a command-and-control server.
Booter: A service that sells denial-of-service attacks by the hour. Also called a stresser.
Application-layer attack: Exhausting a server’s processing with valid requests rather than its link.
Rapid Reset: An HTTP/2 attack that sends and cancels requests faster than the server can start them.
Loop DoS: Making two servers exchange error messages indefinitely with one spoofed packet.
Overprovisioning: Buying more bandwidth and capacity than normal operation needs.
Anycast: Announcing the same address from many data centers at once.
Scrubbing center: A facility that filters a customer’s traffic during an attack and forwards the rest.
Blackhole routing: Having the provider discard all traffic for one address to save the rest of the network.
Rate limiting: Capping the packets, connections, or requests accepted per source, destination, or operation.
Reverse proxy: A server in front of the origin that serves cached content and forwards the rest.
Content delivery network (CDN): A distributed network of proxies that serves content near users and absorbs floods.
Origin server: The customer’s own server behind a proxy or CDN.
Web application firewall: A filter that inspects HTTP requests and blocks those matching attack rules.
CAPTCHA: A challenge meant to be easy for a person and hard for a program.
Proof-of-work puzzle: Computation a client must perform before the server does expensive work.
Graceful degradation: Disabling expensive features under load so the essential service keeps running.