Common TCP/IP Attacks Explained Simply

When you connect to the internet, your computer communicates using TCP/IP protocols. These protocols are like the postal system of the internet; they handle how data gets packaged, addressed, and delivered. Unfortunately, attackers have found ways to exploit weaknesses in this system. Let's explore the most common TCP/IP attacks you need to know about for the CCST Cybersecurity exam.

Understanding the TCP/IP Attack Surface

TCP/IP wasn't originally designed with security in mind. Created in the 1970s for trusted academic networks, these protocols assume good intentions. This trust-based design creates opportunities for malicious actors to intercept, modify, or disrupt communications.

TCP SYN Flood Attacks

One of the most common network threats targets the TCP handshake process. In a normal connection, your computer sends a SYN packet, the server responds with SYN-ACK, and you complete the handshake with ACK. This is called the three-way handshake.

In a SYN flood attack, the attacker sends thousands of SYN packets but never completes the handshake. The server keeps waiting for the final ACK, consuming resources until it can't accept legitimate connections. It's like someone repeatedly calling a restaurant to make reservations but never showing up, eventually, the restaurant can't seat real customers because they think they are fully booked.

Real-World Impact

SYN flood attacks can bring down web servers, email systems, and any service that accepts TCP connections. The 2000 attacks on major websites like Yahoo and CNN used this technique as part of larger distributed denial-of-service (DDoS) campaigns.

IP Spoofing Attacks

IP spoofing involves forging the source address in IP packets. Think of it like putting a fake return address on mail. The attacker sends packets that appear to come from a trusted source, potentially bypassing security controls that rely on IP addresses for authentication.

This attack enables other threats like:

• Man-in-the-middle attacks: Intercepting communications between two parties
• Session hijacking: Taking over legitimate user sessions
• Amplification attacks: Using innocent servers to flood targets with traffic

TCP Sequence Prediction

TCP uses sequence numbers to ensure packets arrive in order and detect missing data. Early implementations used predictable patterns for these numbers. Attackers could predict the next sequence number and inject malicious packets into legitimate connections.

Modern systems use random sequence numbers, making this attack much harder. However, poorly implemented systems still fall victim to sequence prediction attacks.

ARP Poisoning

While not strictly a TCP/IP attack, ARP poisoning targets the Address Resolution Protocol that maps IP addresses to physical MAC addresses on local networks. Attackers send fake ARP responses, redirecting traffic intended for other devices to their own machine.

This allows attackers to:

• Intercept sensitive data like passwords
• Modify web pages before users see them
• Perform denial-of-service attacks on local network segments

Common Attack Indicators

Network administrators watch for these warning signs:

• Unusually high connection attempts from single sources
• Traffic from impossible or suspicious source addresses
• Connections that never complete the TCP handshake
• Unexpected changes in ARP tables
• Performance degradation during peak attack periods

Basic Protection Strategies

Understanding these cybersecurity basics helps you implement appropriate defenses:

Rate limiting: Restrict how many connections a single source can initiate per second. This mitigates SYN flood attacks without blocking legitimate users.

Ingress/egress filtering: Block packets with invalid source addresses at network boundaries. If a packet claims to come from your internal network but arrives from the internet, it's clearly spoofed.

Randomization: Use unpredictable sequence numbers and other identifiers to prevent prediction attacks.

What's Next

Now that you understand common TCP/IP attacks, the next step is learning about application-layer threats. We'll explore how attackers target specific services like web servers and email systems, building on the network-level knowledge you've gained here.