CompTIA Network+: Common Network Attack Types

1. Introduction

Network attacks are attempts to gain unauthorised access to network resources, steal information, disrupt services, or compromise the confidentiality, integrity, and availability of systems.

Network security involves using appropriate controls to monitor, detect, prevent, and respond to attacks. Understanding common attack types helps network professionals recognise vulnerabilities and select effective countermeasures.

This article covers the key attack types in the CompTIA Network+ N10-009 course:

• Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS)
• VLAN hopping
• Media Access Control (MAC) flooding
• Address Resolution Protocol (ARP) spoofing and poisoning
• DNS poisoning and spoofing
• Rogue devices and services
• Evil twin attacks
• On-path attacks
• Social engineering
• Malware attacks

2. Denial-of-Service (DoS) Attacks

A Denial-of-Service attack attempts to make a server, network, or service unavailable by overwhelming it with excessive traffic or requests, or by exhausting its resources.

For example, an attacker may send so many requests to a company website that legitimate customers can no longer access it.

DoS vs DDoS

A DoS attack typically originates from one system or a limited source. A Distributed Denial-of-Service attack uses multiple systems to attack the same target, making the attack more difficult to block.

Attack type	Description
DoS	Attempts to disrupt a service using excessive traffic or resource consumption.
DDoS	Uses multiple systems to overwhelm a target.

Four common DoS attack categories

1. Volumetric attacks

These attacks consume network bandwidth by sending large amounts of traffic. The objective is to prevent legitimate traffic from reaching the target.

2. Fragmentation attacks

These attacks exploit how systems handle fragmented IP packets. Malformed or overlapping fragments may consume resources or trigger weaknesses in packet reassembly.

3. TCP state exhaustion

These attacks consume resources associated with maintaining TCP connections or connection states. A system may become unable to handle legitimate connection requests.

4. Application-layer attacks

These attacks target applications or services, such as web servers. They may use a large number of requests that appear legitimate but consume excessive processing power or memory.

Why do attackers launch DoS attacks?

Common motivations include:

• Revenge or personal disputes.
• Competition between organisations.
• Hacktivism.
• Extortion or ransom demands.
• Disruption for entertainment or mischief.

Prevention and mitigation

Organisations can reduce the impact of DoS and DDoS attacks through:

• Network traffic monitoring.
• Establishing normal traffic baselines.
• Rate limiting and filtering where appropriate.
• Using suitable DDoS protection services.
• Testing resilience through authorised simulations.
• Reviewing incidents and improving defences afterwards.

The key exam point is that DoS attacks target availability.

3. VLAN Hopping Attacks

A Virtual Local Area Network (VLAN) separates devices into logical network segments. VLAN hopping is an attack that attempts to access traffic or resources belonging to a VLAN that the attacker should not be able to access.

The attack may exploit weaknesses in VLAN tagging or switch configuration.

Understanding VLAN tagging

IEEE 802.1Q is a standard used to identify VLAN membership in Ethernet frames. Trunk links can carry traffic for multiple VLANs between network devices.

Incorrect switch configuration can create opportunities for VLAN hopping.

Two common VLAN hopping techniques

Double tagging

In a double-tagging attack, an attacker crafts a frame with two VLAN tags. Under certain switch configurations, the first switch may remove the outer tag, leaving the second tag to influence how the frame is handled by another switch.

This technique depends on the network topology and configuration. It is commonly associated with weaknesses involving native VLAN handling.

Switch spoofing

Switch spoofing attempts to trick a switch into treating an attacker's device as another switch. If trunk negotiation is improperly enabled, the attacker may establish a trunk link and gain access to traffic from multiple VLANs.

Prevention

Administrators can reduce VLAN hopping risks by:

• Avoiding use of the default VLAN for ordinary user traffic.
• Disabling dynamic trunk negotiation on ports that do not require it.
• Configuring unused ports as access ports and disabling them where practical.
• Explicitly configuring trunk ports.
• Using a dedicated, unused native VLAN where appropriate.
• Restricting which VLANs are permitted on trunk links.
• Reviewing switch configurations regularly.

The key exam point is that VLAN hopping exploits VLAN and switch configuration weaknesses to cross intended network boundaries.

4. Media Access Control (MAC) Flooding Attacks

Switches maintain a MAC address table that associates device MAC addresses with switch ports. This allows the switch to forward Ethernet frames to the correct destination port.

A MAC flooding attack attempts to fill the switch's MAC address table with large numbers of fabricated MAC addresses.

How MAC flooding works

1. The attacker sends many Ethernet frames containing fake source MAC addresses.
2. The switch's MAC address table becomes full or reaches its operating limit.
3. Depending on the switch and its configuration, traffic for unknown destinations may be flooded out multiple ports within the relevant VLAN.
4. This may expose traffic that would otherwise have been forwarded only to a particular destination.

The result can be increased traffic, reduced performance, and potential information exposure.

Not every switch behaves identically when its table is full. The impact depends on the device's implementation and security controls.

Prevention

Organisations can reduce the risk by using:

• Port security: Limits the number of MAC addresses learned on a switch port.
• Network monitoring: Identifies unusual increases in MAC addresses or abnormal traffic.
• VLAN segmentation: Helps limit the area affected by an incident.
• MAC address controls: Can provide an additional restriction where appropriate.

MAC flooding does not have one universal software patch. Prevention relies on secure switch configuration, monitoring, and limiting the impact of the attack.

5. ARP Spoofing and ARP Cache Poisoning

The Address Resolution Protocol (ARP) helps devices on an IPv4 local network discover the MAC address associated with an IPv4 address.

ARP does not provide built-in authentication. This creates an opportunity for an attacker to send false ARP information.

How ARP spoofing works

Suppose a computer needs to communicate with its default gateway. It uses ARP to discover the gateway's MAC address.

An attacker on the same local network may send forged ARP messages claiming that the attacker's MAC address belongs to the gateway's IP address.

If the victim accepts the false information, its ARP cache may store an incorrect mapping. This is known as ARP cache poisoning.

Traffic intended for the gateway may then be sent to the attacker's device.

Possible consequences

ARP spoofing and poisoning can lead to:

• Denial-of-Service.
• Session hijacking.
• On-path or man-in-the-middle attacks.
• Unauthorised observation or modification of traffic.

Prevention

Useful protective measures include:

• Dynamic ARP Inspection on supported switches.
• DHCP snooping as a supporting control where appropriate.
• Network monitoring and ARP anomaly detection.
• Static ARP entries for carefully selected systems where practical.
• Network segmentation and controlled access.
• Encrypted protocols such as TLS and SSH.
• VPNs where appropriate for protecting traffic over untrusted networks.
• Regular authorised security testing.

Encryption is particularly important because it can help protect the contents of communications even if traffic is intercepted.

The key exam point is that ARP spoofing targets the relationship between IPv4 addresses and MAC addresses on a local network.

6. DNS Poisoning and DNS Spoofing

The Domain Name System (DNS) translates domain names into information used to locate network services, including IP addresses.

For example, a user enters a website name into a browser. DNS helps the device find the address associated with that name.

DNS poisoning and spoofing attacks attempt to provide false DNS information, potentially redirecting users to malicious systems.

How DNS attacks work

An attacker may manipulate DNS records, responses, or caches so that a legitimate domain name resolves to an incorrect IP address.

A victim may believe they are visiting a trusted website while actually connecting to a malicious server.

Attacks may target DNS servers, client-side caches, or local HOSTS files. In some scenarios, ARP spoofing may also be used to redirect traffic towards an unauthorised DNS server.

DNS poisoning vs DNS spoofing

The terms are sometimes used interchangeably, but they can describe different aspects of an attack.

• DNS spoofing: Forging or manipulating DNS responses or information.
• DNS cache poisoning: Causing false DNS information to be stored in a resolver's cache so that subsequent requests may receive an incorrect answer.

Prevention

Organisations can reduce DNS attack risks through:

• DNS Security Extensions (DNSSEC), where properly deployed and validated.
• Secure configuration and patching of DNS servers.
• Network monitoring and firewall controls.
• Protecting administrative access to DNS infrastructure.
• Using HTTPS and checking website certificate warnings.
• User awareness training.

DNSSEC helps validate the authenticity and integrity of signed DNS data. It does not encrypt DNS queries or replace HTTPS.

HTTPS helps protect the connection to a website, but users should still pay attention to certificate warnings and unexpected domain names.

The key exam point is that DNS attacks can redirect users by supplying false name-resolution information.

7. Rogue Devices and Services

A rogue device or service is hardware or software operating on a network without appropriate authorisation.

Rogue devices may be introduced accidentally by employees or deliberately by attackers. They can create security weaknesses because they may bypass the organisation's approved controls.

Common examples

Unauthorised wireless access points

An employee may connect a personal wireless router to a corporate network. If poorly secured, it may provide an alternative path into the network.

Rogue DHCP servers

A DHCP server automatically provides network configuration, such as IP addresses and gateway details. An unauthorised DHCP server may supply incorrect settings and redirect traffic.

Rogue DNS servers

An unauthorised DNS server may provide false name-resolution information or direct users towards malicious destinations.

Unmanaged mobile and IoT devices

Personal phones, cameras, smart devices, and other equipment may contain outdated software or weak security settings.

Bring Your Own Device (BYOD) policies can increase these risks if personal devices are allowed to connect without appropriate security checks.

Possible consequences

Rogue devices and services may lead to:

• Malware infections.
• Data theft.
• Unauthorised access.
• Traffic interception.
• Network disruption.
• Insider threats or accidental policy violations.

Prevention and detection

Organisations can use:

• Network access control.
• Intrusion detection and monitoring tools.
• Network discovery and authorised port scanning.
• Device authentication.
• Regular asset inventories and security audits.
• Penetration testing.
• Staff awareness and clear BYOD policies.

The key exam point is that rogue devices and services are unauthorised components that may bypass approved network controls.

8. Evil Twin Attacks

An evil twin attack uses a fake wireless access point that imitates a legitimate Wi-Fi network.

Attackers may set up a network with the same or a similar name to a trusted network in a café, hotel, airport, or other public location.

A user may connect to the fake network believing it is genuine.

How an evil twin attack works

1. An attacker creates a fake Wi-Fi network.
2. The network uses a name that resembles a legitimate one.
3. A victim connects to it, potentially because their device automatically joins a familiar network.
4. The attacker may attempt to intercept traffic, collect credentials, or redirect the user to malicious content.

The extent of access depends on the network setup and the victim's behaviour. Connecting to an evil twin does not automatically mean that all encrypted traffic can be read.

Prevention

Users should:

• Verify the correct Wi-Fi network name with the provider.
• Avoid entering sensitive information on untrusted networks.
• Disable automatic connection to unfamiliar or unnecessary Wi-Fi networks.
• Use a personal hotspot for sensitive activity when appropriate.
• Use a reputable VPN when protection against local network interception is needed.
• Enable multi-factor authentication.
• Keep operating systems and security software updated.
• Pay attention to browser and certificate warnings.

A VPN can protect traffic between a device and the VPN endpoint, but it does not guarantee safety from phishing, malware, or every form of attack.

The key exam point is that an evil twin is a fraudulent Wi-Fi access point designed to imitate a legitimate network.

9. On-Path Attacks

An on-path attack occurs when an attacker gains a position on the communication path between two parties and can observe or potentially modify their traffic.

It is commonly associated with the broader category of man-in-the-middle attacks.

For example, an attacker may position themselves between a user and a service, allowing them to attempt to intercept communication without the user necessarily realising that the connection has been compromised.

Possible consequences

An on-path attacker may attempt to:

• Capture sensitive information.
• Observe unprotected communications.
• Modify data in transit.
• Steal session information.
• Redirect users or interfere with transactions.

The attacker's capabilities depend on the protocols, encryption, authentication, and network conditions involved.

Prevention

Organisations and users can reduce risk through:

• TLS-protected communications.
• Verifying website certificates and investigating certificate warnings.
• Secure email protection, such as S/MIME where appropriate.
• VPNs for protecting traffic over untrusted networks.
• Strong authentication and multi-factor authentication.
• Secure Wi-Fi configuration.
• Monitoring for unusual network behaviour.

TLS can protect the confidentiality and integrity of data in transit when correctly configured and when authentication is properly validated.

The key exam point is that an on-path attack places the attacker between communicating parties to observe or interfere with their communications.

10. Social Engineering Attacks

Social engineering attacks exploit human behaviour rather than relying solely on technical weaknesses.

An attacker may impersonate a trusted organisation, colleague, manager, bank, or technical support worker to persuade a victim to reveal information or perform an unsafe action.

Common social engineering techniques

Phishing

Fraudulent messages attempt to trick users into clicking malicious links, opening harmful attachments, or revealing sensitive information.

Vishing

Voice phishing uses phone calls or voice messages to deceive victims.

Fake websites

Attackers create websites that resemble legitimate services to steal passwords, payment details, or personal information.

Cloned social media accounts

An attacker may copy another person's profile to impersonate them and request money, sensitive information, or assistance.

Helpdesk fraud

An attacker pretends to be an employee or authorised user and tries to persuade IT support to reset a password, disclose information, or grant access.

How to recognise social engineering

Warning signs include:

• Unexpected requests for passwords or verification codes.
• Urgent demands to transfer money or change payment details.
• Unusual links or attachments.
• Requests to bypass normal procedures.
• Messages that create fear, pressure, or excitement.
• Unexpected requests from familiar contacts using unusual communication channels.

Prevention

The best defence combines user awareness with technical and organisational controls.

Users should verify unusual requests through a trusted channel, avoid sharing passwords or one-time authentication codes, and report suspicious messages.

Organisations should provide regular training, enforce approval procedures for sensitive actions, and use email security controls and multi-factor authentication.

Financial institutions and legitimate service providers may send verification messages through approved channels, so the important lesson is to verify the request using the organisation's official contact details rather than trusting an unsolicited message.

The key exam point is that social engineering manipulates people into compromising security.

11. Common Malware Attacks

Malware is malicious software designed to damage systems, disrupt operations, steal information, spy on users, or provide unauthorised access.

Attackers may use malware for financial gain, espionage, disruption, or extortion.

Common malware types

Virus

A virus attaches itself to a file or program and spreads when the infected content is executed. It commonly requires some form of user or system action to spread.

Worm

A worm can replicate and spread across systems or networks without needing to attach itself to another file in the same way as a traditional virus.

Trojan horse

A Trojan disguises itself as legitimate or useful software. Once installed or executed, it may perform malicious actions.

Ransomware

Ransomware encrypts files or otherwise prevents access to systems and demands payment. Some attackers also steal information and threaten to publish it.

Spyware

Spyware secretly monitors user activity or collects information.

Adware

Adware displays unwanted advertisements. Some forms also track user behaviour or introduce additional security risks.

Bot malware

Bot malware allows an infected device to be controlled remotely. Multiple infected devices may form a botnet, which can be used for activities such as DDoS attacks.

Rootkit

A rootkit is designed to conceal malicious activity or maintain privileged access to a system. Some rootkits are particularly difficult to detect because they attempt to hide their presence.

Common malware delivery methods

Malware may be delivered through:

• Malicious email attachments.
• Phishing links.
• Compromised websites.
• Trojan applications.
• Exploitation of unpatched vulnerabilities.
• Infected removable media.
• Compromised devices or network services.

Malware prevention and recovery

Organisations can reduce the risk through:

• Updated antimalware and endpoint protection.
• Timely security patches.
• User education.
• Strong access controls.
• Network segmentation.
• Secure email and web filtering.
• Regular security audits.
• Tested backups stored with appropriate protection.

Backups are particularly important for recovery from ransomware and other destructive attacks. They should be protected from unauthorised modification and periodically tested to confirm that restoration works.

The key exam point is to recognise malware by its behaviour and understand that different malware types have different purposes.

12. Quick Comparison Table

Attack	What it targets	Typical impact	Main defensive approach
DoS	Service or device availability	Service becomes unavailable	Traffic monitoring, filtering, and resilience measures
DDoS	Availability using multiple systems	Large-scale service disruption	DDoS protection, traffic analysis, and filtering
VLAN hopping	VLAN separation and switch configuration	Unauthorised access across VLANs	Secure trunk configuration and VLAN controls
MAC flooding	Switch MAC address table	Traffic flooding and possible exposure	Port security and monitoring
ARP spoofing	IPv4-to-MAC address mappings	Traffic interception or redirection	Dynamic ARP Inspection and encrypted protocols
DNS poisoning	DNS records or caches	Users redirected to incorrect destinations	DNSSEC validation and secure DNS administration
Rogue devices	Unauthorised hardware or services	Uncontrolled network access	NAC, asset inventories, and monitoring
Evil twin	Wireless network trust	Fake Wi-Fi connection and potential interception	Verify networks, disable auto-connect, and use appropriate encryption
On-path	Communication between two parties	Interception or modification of traffic	TLS, certificate validation, and secure connections
Social engineering	Human behaviour and trust	Credential theft or unauthorised actions	Awareness training and independent verification
Malware	Devices, files, and systems	Data theft, disruption, spying, or extortion	Patching, endpoint protection, access control, and backups

13. Practical Scenario

Imagine a company experiences several security incidents.

An employee reports that the company website is unavailable because of an overwhelming volume of traffic. This may indicate a DoS or DDoS attack.

Another employee discovers that a device connected to the wrong VLAN can access resources it should not reach. The security team should investigate possible VLAN hopping and switch misconfiguration.

Network monitoring then detects many unfamiliar MAC addresses on a switch port. This may indicate MAC flooding.

Separately, staff report that a familiar website is directing them to an unexpected address. The team should investigate DNS resolution, DNS cache poisoning, and other possible redirection methods.

Finally, an employee receives a message from someone claiming to be IT support and asking for their password. This is a potential social engineering attempt.

Each incident requires the organisation to identify the attack, investigate the cause, contain the risk, and apply suitable corrective controls.

The important skill is matching the observed symptoms to the likely attack type without assuming that one symptom always proves a particular attack.

14. Exam Revision: Key Points to Remember

Before taking the CompTIA Network+ N10-009 course test, review these points:

• DoS: Attempts to make a service unavailable.
• DDoS: Uses multiple systems to attack a target.
• Volumetric attack: Consumes bandwidth.
• TCP state exhaustion: Consumes resources associated with connection states.
• VLAN hopping: Attempts to cross VLAN boundaries through techniques such as double tagging or switch spoofing.
• MAC flooding: Fills a switch's MAC address table with fabricated addresses.
• ARP spoofing: Sends false IP-to-MAC mappings on a local IPv4 network.
• DNS poisoning: Causes false DNS information to be used or cached.
• Rogue device: Unauthorised hardware or service on a network.
• Evil twin: A fake Wi-Fi network imitating a legitimate one.
• On-path attack: An attacker positions themselves in the communication path.
• Social engineering: Manipulates people into revealing information or taking unsafe actions.
• Virus: Typically attaches to a file or program.
• Worm: Can replicate and spread independently.
• Trojan: Disguises itself as legitimate software.
• Ransomware: Denies access to data or systems, commonly through encryption or other forms of extortion.
• Spyware: Secretly collects information or monitors activity.
• Bot malware: Enables remote control of an infected device.
• Rootkit: Helps conceal malicious activity or maintain privileged access.

15. Conclusion

Common network attacks exploit weaknesses in availability, network configuration, address resolution, wireless trust, communication protocols, devices, software, and human behaviour.

Network professionals need to recognise the signs of these attacks and understand which controls are appropriate. Secure configurations, network segmentation, access control, encryption, patching, monitoring, staff awareness, and reliable backups all help reduce risk.

For the CompTIA Network+ exam, focus on identifying each attack from a scenario, understanding its target and likely impact, and selecting the most suitable mitigation. This will help you apply the concepts in practical network security situations.