Sniffing on a switched network requires:
Sniffing, Session Hijacking and DoS Attacks
Sniffers and passive vs. active sniffing, protocols vulnerable to sniffing, switch CAM tables and MAC flooding, ARP poisoning and its prevention, session hijacking (prediction, active-session identification, spoofing vs. hijacking), and DoS/DDoS techniques and botnets.
How to read this page
Every original slide is shown unchanged. Yellow marks on a slide point to a numbered note: hover or tap a mark to jump to its note, and hover a note to see its marks. Questions tagged Past exam appeared on a real paper; Prediction questions are likely angles, not confirmed. Pick an answer to each question: a wrong pick tells you why it is wrong, so you can try again.
All 60 slides
- 1 Slide 1
- 2 Key Concepts
- 3 Slide 3
- 4 Sniffers
- 5 Sniffing Threats
- 6 How a Sniffer Works
- 7 Types of Sniffing
- 8 § Passive sniffing involves sending no packets. It simply captures and
- 9 Attackers use the following passive sniffing methods to gain control over a target
- 10 Types of Sniffing (cont.)
- 11 Types of Sniffing (cont.)
- 12 Detectability: Leaving Fingerprints
- 13 Protocols Vulnerable to Sniffing
- 14 Switch Basics & CAM Table
- 15 How CAM Works
- 16 ARP Protocol Basics
- 17 MAC Flooding attack
- 18 Slide 18
- 19 How to Defend against MAC Attacks
- 20 Slide 20
- 21 Slide 21
- 22 ARP Poisoning / ARP Spoofing
- 23 How does ARP Poisoning Works
- 24 How Does ARP Spoofing Work
- 25 Why is ARP Poisoning Possible?
- 26 ARP Spoofing Prevention
- 27 ARP Spoofing Prevention (Cont..)
- 28 ARP Spoofing Prevention (cont..)
- 29 Detection Tip: Monitor networks for a single MAC address associated with multiple IP addresses or use tools like Wireshark to spot unusual ARP traffic. Here is a simple way to detect that a specific device’s ARP cache has been poisoned, using the command line. Start an operating system shell as an administrator. Use the following command to display the ARP table, on both
- 30 Sniffing Tools
- 31 Sniffing Countermeasures
- 32 Slide 32
- 33 What is Session Hijacking?
- 34 Slide 34
- 35 Why Session Hijacking Is Successful
- 36 Example: Linear Algorithm Generating Weak Session IDs
- 37 Improvement using secure, random, cryptographic session ID generator
- 38 Slide 38
- 39 An attacker implements various techniques such as stealing, guessing, and brute forcing to obtain a valid session ID, which helps in acquiring control over a valid user’s session while it is in progress.
- 40 Identifying an Active Session
- 41 Identifying an Active Session (Cont.)
- 42 Identifying an Active Session (Cont.)
- 43 Slide 43
- 44 Spoofing vs Hijacking
- 45 Session Hijacking Tools
- 46 Session Hijacking Tools (Cont.)
- 47 Thwarting Session Hijacking Attacks
- 48 Slide 48
- 49 Denial of Service (DoS) Attacks
- 50 DoS Attack Techniques :
- 51 Bandwidth Attacks
- 52 Service Request Floods
- 53 ICMP Flood Attack
- 54 § ICMP flood — Comes in two variants: Smurf attack and ping
- 55 SYN Flooding
- 56 Peer-to-Peer Attacks
- 57 Application-Level Flood Attacks
- 58 What are Distributed Denial of Service Attacks?
- 59 Botnet
- 60 Summary
Slide 1
Key Concepts
Slide 3
Sniffers
Notes
A sniffer captures packets on the network; the NIC runs in promiscuous mode.
Sniffing Threats
How a Sniffer Works
Types of Sniffing
Notes
Passive sniffing: just listen (works on hubs). Active sniffing: inject traffic to sniff a switched network (MAC flooding, ARP poisoning).
Exam angle
§ Passive sniffing involves sending no packets. It simply captures and
Attackers use the following passive sniffing methods to gain control over a target
Types of Sniffing (cont.)
Types of Sniffing (cont.)
Detectability: Leaving Fingerprints
Protocols Vulnerable to Sniffing
Notes
Plaintext protocols leak credentials: Telnet, FTP, HTTP, POP3, IMAP, SMTP, SNMPv1.
Exam angle
Which protocol sends credentials in clear text?
Switch Basics & CAM Table
How CAM Works
ARP Protocol Basics
MAC Flooding attack
Notes
MAC flooding: fill the CAM table with fake MACs so the switch fails open and floods frames like a hub. Defense: port security.
Exam angle
Port security on a switch defends against:
Slide 18
How to Defend against MAC Attacks
Slide 20
Slide 21
ARP Poisoning / ARP Spoofing
Notes
ARP poisoning: send forged ARP replies linking the attacker’s MAC to the gateway’s IP → man in the middle.
Exam angle
ARP poisoning works because ARP:
How does ARP Poisoning Works
How Does ARP Spoofing Work
Why is ARP Poisoning Possible?
ARP Spoofing Prevention
Notes
ARP spoofing prevention: static ARP entries, Dynamic ARP Inspection (DAI) with DHCP snooping, encryption.
ARP Spoofing Prevention (Cont..)
ARP Spoofing Prevention (cont..)
Detection Tip: Monitor networks for a single MAC address associated with multiple IP addresses or use tools like Wireshark to spot unusual ARP traffic. Here is a simple way to detect that a specific device’s ARP cache has been poisoned, using the command line. Start an operating system shell as an administrator. Use the following command to display the ARP table, on both
Sniffing Tools
Sniffing Countermeasures
Slide 32
What is Session Hijacking?
Notes
Session hijacking: take over an authenticated session by stealing or predicting the session ID.
Slide 34
Why Session Hijacking Is Successful
Example: Linear Algorithm Generating Weak Session IDs
Notes
Predictable (linear) session IDs can be guessed; use long, random IDs.
Improvement using secure, random, cryptographic session ID generator
Slide 38
An attacker implements various techniques such as stealing, guessing, and brute forcing to obtain a valid session ID, which helps in acquiring control over a valid user’s session while it is in progress.
Identifying an Active Session
Identifying an Active Session (Cont.)
Identifying an Active Session (Cont.)
Slide 43
Spoofing vs Hijacking
Notes
Spoofing pretends to be another user to START a session; hijacking takes over an EXISTING session.
Exam angle
Taking over a session that a user has already authenticated is:
Session Hijacking Tools
Session Hijacking Tools (Cont.)
Thwarting Session Hijacking Attacks
Notes
Thwart hijacking: encryption (HTTPS, IPsec), random session IDs, timeouts, re-authentication.
Slide 48
Denial of Service (DoS) Attacks
Notes
DoS: make a resource unavailable. DDoS: from many sources (a botnet).
DoS Attack Techniques :
Bandwidth Attacks
Service Request Floods
ICMP Flood Attack
Notes
ICMP flood / Smurf (spoofed broadcast pings). Ping of death: oversized packets.
§ ICMP flood — Comes in two variants: Smurf attack and ping
SYN Flooding
Notes
SYN flood: many SYNs without the final ACK fill the half-open connection queue. Defense: SYN cookies.
Exam angle
A SYN flood exploits:
SYN cookies defend against:
Peer-to-Peer Attacks
Application-Level Flood Attacks
What are Distributed Denial of Service Attacks?
Botnet
Notes
Botnet: compromised "zombie" machines controlled by a command-and-control (C&C) server.
Summary
