Skip to main content

Network and Protocol Attacks

Premium

As a security engineer, you should know about the most common network and protocol attacks: how they work, where they occur, and how to defend against them. Interviewers aren’t expecting you to memorize every exploit; they want to see that you can reason through threats, identify weak points, and propose layered defenses.

This lesson will help you:

  • Recognize common attacks and their key characteristics.
  • Map attacks to the layers of the network stack.
  • Propose structured, practical defenses in interview scenarios.

What to expect

Example interview prompts:

  • “How would you prevent a MITM attack?”
  • “A user reports slow network performance. How would you check for ARP spoofing?”
  • “Your public API is under a DDoS attack. How do you respond?”

The majority of questions on network and protocol attack are scenario-based.

When answering:

  1. Identify the threat. “An attacker could intercept unencrypted traffic.”
  2. Explain the cause. “The system uses HTTP instead of HTTPS.”
  3. Propose defenses. “Implement TLS, verify certificates, and monitor for downgrade attempts.”
  4. Summarize the impact and list the tradeoffs. “This protects against eavesdropping and data manipulation.”

Common network attacks

The table below summarizes the most common network attacks you should know as a security engineer. For each type, it explains what the attack is and how engineers defend against it. This provides a clear view of both the threat and the real-world mitigation strategies.

CategoryDescriptionKey defense
SpoofingPretending to be another system or identity.Authentication, integrity checks, ingress filtering
InterceptionEavesdropping or tampering with traffic.TLS, VPNs, certificate validation
Denial of Service (DoS)Overloading a service to make it unavailable.Rate limiting, load balancing, DDoS protection
Replay or Session HijackingReusing valid sessions or tokens.Nonces, short-lived tokens, strict session validation
Lateral MovementSpreading across internal systems.Network segmentation, least privilege, monitoring

Example: ARP spoofing

Prompt: “A user reports slow network performance. How would you check for ARP spoofing?”

Strong answer outline:

  1. Explain what ARP spoofing is: tricking devices into sending traffic to the attacker’s MAC address.
  2. Identify detection methods: review ARP tables for duplicate IPs, use monitoring tools.
  3. Recommend prevention: enable Dynamic ARP Inspection and restrict broadcast domains.

Example: Man-in-the-middle (MITM)

Prompt: “How would you prevent a MITM attack?”

Strong reasoning:

  1. Identify threat: attacker intercepts traffic between client and server.
  2. Cause: unencrypted or improperly validated connections.
  3. Defense: use TLS with certificate pinning, enable HSTS, and monitor for DNS anomalies.
  4. Tradeoff: strong validation may add configuration complexity but significantly reduces risk.

Example: Distributed denial of service (DDoS)

Prompt: “Your public API is under a DDoS attack. What’s your response?”

Structured answer:

  1. Detect and confirm through traffic patterns or flow logs.
  2. Contain by filtering or rate limiting through load balancers or a CDN.
  3. Maintain visibility through metrics and logging.
  4. Follow up by tuning rate limits and reviewing infrastructure for resilience.
Next Lesson