DoS and Layer 2 Attacks
Not sure you’re ready?
Take the ~3-minute readiness diagnostic and see where you stand.
Imagine a highly efficient, automated mail-sorting facility. Every package that arrives has a specific destination, and the sorting machines use a precise internal ledger to route each parcel to the correct delivery truck. If the system is functioning perfectly, mail moves swiftly and securely. But what happens if an adversary intentionally floods the loading dock with a million bogus packages? What if they forge the internal ledgers, or trick the sorters into dropping packages into the wrong delivery bins? The entire facility grinds to a halt, or worse, sensitive mail is handed directly to a thief.
Local and wide area networks operate on the exact same principles. The protocols that direct our traffic were designed for efficiency and reliability, often under the assumption that the devices participating in the network are trustworthy. Attackers study these protocols, understand their mechanical behaviors, and exploit their blind spots.
To defend a network infrastructure, you must first deeply understand how it can be broken.
At its core, a Denial of Service (DoS) attack aims to disrupt legitimate user access to a network resource or service. This is not an attack designed to steal data; it is an attack of sheer disruption. A Denial of Service (DoS) attack typically works by exhausting target system resources, such as CPU, memory, or network bandwidth, until the system can no longer respond to valid requests.
However, a single computer rarely has enough power to overwhelm enterprise-grade infrastructure. To achieve massive scale, attackers escalate their methods. A Distributed Denial of Service (DDoS) attack uses a network of multiple compromised devices to attack a single target.
This army of compromised systems is called a botnet—a collection of malware-infected devices controlled by a central attacker command server. Attackers use botnets to generate the massive volume of traffic required for a Distributed Denial of Service (DDoS) attack. These attacks generally fall into three distinct mechanical categories: Volumetric, Protocol, and Application-layer.
Volumetric Attacks: Reflection and Amplification
A volumetric Distributed Denial of Service (DDoS) attack attempts to consume all available network bandwidth of the target organization. Rather than just sending traffic directly, attackers use clever routing tricks to multiply their force.
A reflection attack involves sending requests to legitimate servers using a spoofed source IP address belonging to the victim. Because the internet protocols route responses back to the source IP address provided in the initial packet, the legitimate servers in a reflection attack send their responses directly to the spoofed victim address. The attacker never receives the reply; the victim does.
This becomes catastrophic when combined with amplification. An amplification attack exploits network protocols that return responses significantly larger than the initial request. An attacker sends a tiny, 64-byte query with a spoofed IP, and the server replies with a 3,000-byte response directed at the victim.
Key Vulnerabilities: Both the Domain Name System (DNS) protocol and the Network Time Protocol (NTP) are frequently exploited to execute amplification attacks, because their standard architectures allow short queries to trigger massive, verbose responses.
Protocol and Application-Layer Exhaustion
Instead of relying on pure bandwidth, attackers can exhaust the server's internal mechanisms.
A TCP SYN flood attack exploits the TCP three-way handshake process. Normally, a client sends a SYN, the server replies with a SYN-ACK and waits for the final ACK to establish the connection. An attacker executing a TCP SYN flood sends continuous SYN requests to the target server, but deliberately avoids sending the final ACK packet of the handshake. Because the server must track these pending connections, a TCP SYN flood exhausts the target server's connection state tables by leaving TCP connections in a half-open state. Once the table is full, the server simply drops any new, legitimate connection attempts.
Moving further up the OSI model, application-layer Distributed Denial of Service (DDoS) attacks target specific software application functions. For example, an HTTP GET flood is an application-layer attack designed to exhaust the processing power of a web server. By forcing the server to continuously fetch complex database queries or render dynamic web pages, the attacker starves the server's CPU and memory, effectively taking the website offline.
When we look inside a Local Area Network (LAN), the network switch is the ultimate traffic director. It relies on internal logic to ensure frames are delivered quickly and privately. Attackers exploit this very logic to compromise the local network.
MAC Flooding
A switch operates efficiently because of its Content Addressable Memory (CAM) table, which stores the mappings between MAC addresses and physical switch ports. When a frame arrives, the switch checks the destination MAC address against its CAM table and forwards the frame only out of the corresponding physical port.
MAC flooding is a Layer 2 attack involving the transmission of thousands of ethernet frames with randomized source MAC addresses. The goal of MAC flooding is to exhaust the memory capacity of a network switch's Content Addressable Memory (CAM) table.
Why does this matter? Because of how a switch is programmed to handle the unknown. When a switch receives a frame destined for a MAC address it does not have in its CAM table, it must ensure the frame still reaches its destination. Therefore, a switch reverts to broadcasting all incoming frames out of all ports when its Content Addressable Memory (CAM) table overflows.
This behavior is called "failing open." A switch operating in a fail-open state during a MAC flood allows an attacker to capture network traffic intended for other devices, effectively turning the intelligent switch into a dumb hub.
Mitigation: Network administrators mitigate MAC flooding attacks by enabling port security features on network switches. Switch port security restricts the maximum number of unique MAC addresses permitted to send traffic on a specific physical port. If the threshold is exceeded, the switch can automatically shut down the port, stopping the flood dead in its tracks.
VLAN Hopping
Virtual Local Area Networks (VLANs) logically separate traffic on the same physical switch. The accounting department shouldn't see the guest Wi-Fi traffic, and vice versa. VLAN hopping is a Layer 2 attack allowing a malicious actor to send network traffic to a completely different Virtual Local Area Network (VLAN). Attackers use two primary techniques to achieve this:
| Attack Technique | Mechanics | Mitigation |
|---|---|---|
| Switch Spoofing | An attacker device mimics the behavior of a network switch. The attacker leverages the Dynamic Trunking Protocol (DTP) to negotiate a trunk link with the legitimate switch. A successfully negotiated trunk link grants an attacker access to traffic from all Virtual Local Area Networks (VLANs) allowed on that trunk. | Administrators prevent switch spoofing by explicitly disabling the Dynamic Trunking Protocol (DTP) on all end-user access ports. |
| Double Tagging | The attacker attaches two separate 802.1Q VLAN tags to a single ethernet frame. This exploits the default native VLAN configuration of a network switch. The first switch receiving a double-tagged frame removes the outer native VLAN tag. It then forwards a double-tagged frame with the inner attacker-crafted VLAN tag left intact. The intact inner VLAN tag directs the forwarded frame to the victim's isolated VLAN. | Changing the native VLAN ID to an unused, non-routable VLAN number mitigates double-tagging attacks. |
To move data across a local network, devices need to know the physical hardware addresses of their peers. The Address Resolution Protocol (ARP) maps an IPv4 address to a physical MAC address on a local area network. When your computer needs to send a packet to the default gateway, it shouts out, "Who has IP address 192.168.1.1?" The gateway responds, "I do, and here is my MAC address."
The fatal flaw of this system is that the Address Resolution Protocol (ARP) lacks built-in authentication mechanisms to verify the legitimate sender of an ARP message. It assumes anyone responding is telling the truth.
ARP Spoofing and Poisoning
Attackers exploit this blind trust. ARP spoofing is a technique where an attacker broadcasts falsified ARP reply messages onto the local area network. The goal of ARP spoofing is to artificially associate the attacker's MAC address with the IP address of another legitimate network device, usually the default gateway router.
When the victim's computer receives this falsified message, it updates its internal records. ARP poisoning refers to the corruption of a target device's ARP cache resulting from processing malicious ARP spoofing messages. Consequently, ARP poisoning redirects local network traffic intended for a legitimate device directly to the attacker's network interface.
On-Path Attacks and Defense
Why do attackers want this traffic? Attackers primarily use ARP spoofing to execute On-Path attacks (historically known as Man-in-the-Middle attacks) on a local area network.
An On-Path attack allows an attacker to secretly intercept communications between two network parties, stealing plaintext credentials, session cookies, or sensitive files. Furthermore, an On-Path attack allows an attacker to maliciously alter communications between two network parties—such as changing the destination account number on a financial wire transfer mid-transit—before forwarding the traffic along to the actual gateway so the victim notices no disruption.
Defending the Network: To solve this, enterprise switches utilize Dynamic ARP Inspection (DAI). DAI is a switch security feature that validates incoming ARP packets against a trusted IP-to-MAC database (usually generated by DHCP snooping). If an attacker attempts to spoof an ARP reply, Dynamic ARP Inspection (DAI) drops ARP packets containing invalid MAC-to-IP bindings, neutralizing the threat before the network's ARP caches can be poisoned.
By understanding the exact mechanical failures an attacker hopes to trigger—whether exhausting a server's connection states, overflowing a CAM table, manipulating DTP, or abusing the trusting nature of ARP—you transition from merely reacting to network outages to architecting resilient, heavily fortified infrastructure.