Network Security Fundamentals
Common network attacks, how firewalls work, IDS vs IPS, and using nmap for reconnaissance.
Learning Objectives
- → Identify ARP spoofing, port scanning, and packet sniffing attacks
- → Explain how stateful firewalls filter traffic
- → Distinguish IDS from IPS
- → Use nmap for basic host and service discovery
Network Threats
Common Attacks
ARP Spoofing (ARP Poisoning)
An attacker sends fake ARP replies to associate their MAC address with a legitimate IP, redirecting traffic through them — enabling a Man-in-the-Middle (MITM) attack.
Normal: Host A → "Who has 192.168.1.1?" → Router responds with real MAC
Attack: Attacker → poisons Host A's ARP cache with attacker's MAC for 192.168.1.1
Result: Host A sends all traffic to attacker instead of router
Port Scanning
Attackers probe which ports are open on a target to identify running services and potential vulnerabilities.
Packet Sniffing
Capturing network traffic on a shared medium. On unencrypted protocols (Telnet, HTTP) credentials are visible in plaintext.
DoS / DDoS
Flooding a target with traffic to exhaust resources and cause service disruption.
Firewalls
A firewall inspects and filters network traffic based on rules.
Types
| Type | How it works | Example |
|---|---|---|
| Packet filter | Checks src/dst IP, port, protocol | iptables, ACLs |
| Stateful | Tracks connection state (established, new) | Most modern firewalls |
| Application (L7) | Inspects payload/content | WAF, Palo Alto NGFW |
| Proxy | Acts as intermediary, full content inspection | Squid, Zscaler |
iptables Example (Linux)
# Block all incoming traffic on port 23 (Telnet)
sudo iptables -A INPUT -p tcp --dport 23 -j DROP
# Allow established connections
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# List current rules
sudo iptables -L -n -v
IDS vs IPS
| Feature | IDS (Intrusion Detection System) | IPS (Intrusion Prevention System) |
|---|---|---|
| Action | Detects and alerts | Detects and blocks |
| Placement | Passive (monitor copy of traffic) | Inline (traffic passes through it) |
| Impact if fails | None (traffic unaffected) | Can block legitimate traffic |
| Example | Snort in alert mode | Snort in inline mode, Suricata |
nmap — Network Mapper
# Ping sweep — find live hosts
sudo nmap -sn 192.168.1.0/24
# TCP SYN scan (fast, stealthy)
sudo nmap -sS 192.168.1.1
# Service/version detection
nmap -sV 192.168.1.1
# OS detection
sudo nmap -O 192.168.1.1
# Scan top 1000 ports with service detection
nmap -sV -sC 192.168.1.1
# Scan all 65535 ports
nmap -p- 192.168.1.1
# Save output
nmap -oN scan.txt 192.168.1.1
nmap -oX scan.xml 192.168.1.1 # XML (for tools)
nmap Output Explained
22/tcp open ssh OpenSSH 8.4
80/tcp open http Apache httpd 2.4.51
443/tcp open https Apache httpd 2.4.51
3306/tcp open mysql MySQL 8.0.27
Each line: port/protocol state service version
Defensive Nmap — Check Your Own Exposure
# What does the internet see on your server?
nmap -sV -Pn your.server.ip
# Check for known vulnerabilities (NSE scripts)
nmap --script vuln your.server.ip
Understanding attacks is the first step in defending against them. Here are the most common network-level threats.
🎭 ARP Spoofing / MITM
Attacker sends fake ARP replies, poisoning the ARP cache. Victim's traffic redirected through attacker. Enables eavesdropping and injection.
🔍 Port Scanning
Attacker probes which ports are open to identify services. Open ports reveal attack surface. SYN scans are stealthier than full-connect scans.
👂 Packet Sniffing
Capturing raw network traffic. On unencrypted protocols (Telnet, HTTP, FTP) — credentials are visible in plaintext.
💥 DoS / DDoS
Flooding target with traffic to exhaust bandwidth or compute resources. DDoS uses many infected machines (botnet) simultaneously.
ARP Spoofing enables which type of attack?
Which protocol being used means credentials are sent in plaintext?
A firewall inspects and filters network traffic based on rules. It's the first line of defence at the network perimeter.
| Type | How it works | Example |
|---|---|---|
| Packet Filter | Checks src/dst IP, port, protocol — stateless | iptables ACL |
| Stateful | Tracks connection state (NEW, ESTABLISHED, RELATED) | Most modern FW |
| Application (L7) | Inspects payload/content — deep packet inspection | WAF, NGFW |
| Proxy | Full intermediary — client talks to proxy, not server | Squid, Zscaler |
A stateful firewall tracks:
Which iptables target DROPS a packet silently?
Firewalls enforce policy. IDS/IPS detect anomalies and attacks inside the network.
🔔 IDS — Intrusion Detection
- Passive — copies of traffic
- Detects and alerts only
- Zero impact on traffic flow
- Example: Snort (alert mode)
🛑 IPS — Intrusion Prevention
- Inline — traffic passes through it
- Detects and blocks malicious traffic
- Single point of failure risk
- Example: Snort inline, Suricata
An IPS differs from an IDS because an IPS can:
Which nmap flag performs a TCP SYN (half-open) scan?
💪 Exercises & Challenges
Scan Your Own Network
## Task: Network Reconnaissance (Ethical — your own systems only) **Warning**: Only scan networks and systems you own or have explicit permission to scan. ### Steps **1. Discover live hosts:** ```b
Banner Grab Challenge
Use netcat to grab the service banner from a target. On your own machine, start a simple netcat listener: ```bash echo "FLAG{banner_grabbed_successfully}" | nc -l 9999 ``` Then in another terminal,