Network Security Basics

Every protocol we've studied was designed assuming cooperative participants. Real networks face adversaries. This chapter covers firewalls, common attacks, and defences.

Firewalls

A firewall inspects traffic and permits or denies it based on rules. Two main approaches:

• Stateless (packet-filter) firewall: matches each packet in isolation against ACL rules (source/destination IP, port, protocol). Fast but cannot track connection state — typically applied at network perimeters for coarse filtering.
• Stateful firewall: tracks connection state (the state machine for each TCP flow, UDP associations). Can distinguish legitimate reply traffic from unsolicited inbound packets. The dominant approach for host and perimeter firewalls today.

Next-generation firewalls (NGFW) add layer-7 inspection, application identification, IDS/IPS, TLS inspection (via MITM proxy), and user-identity awareness.

TLS and mTLS

TLS secures the channel but only authenticates the server to the client by default. Mutual TLS (mTLS) requires the client to also present a certificate. This is used in zero-trust architectures, service meshes (e.g. Istio), and API security — ensuring both parties are authenticated before any data flows.

Common attacks and defences

SYN flood

An attacker sends thousands of TCP SYN packets (often spoofed source IPs) to a server. The server allocates state for each half-open connection, filling its connection table and refusing legitimate connections. Defence: SYN cookies (server encodes state in the ISN rather than allocating memory; legitimate clients complete the handshake), rate limiting, and upstream scrubbing.

ARP spoofing (ARP poisoning)

On a local network, an attacker sends gratuitous ARP replies, claiming their MAC maps to the gateway's IP. Victims update their ARP caches and send traffic to the attacker — a classic LAN-based MITM. Defence: Dynamic ARP Inspection (DAI) on switches, private VLANs, 802.1X port authentication.

DNS spoofing / cache poisoning

An attacker injects false DNS responses into a recursive resolver's cache, redirecting users to malicious IPs. The Kaminsky attack (2008) showed that birthday-collision attacks could poison caches quickly. Defences: DNSSEC (cryptographic signing of DNS records), randomised source ports and transaction IDs, 0x20 case randomisation.

Man-in-the-Middle (MITM)

An attacker interposes themselves between two communicating parties, reading or modifying traffic. On the network level, ARP spoofing or rogue DHCP servers achieve this. Defences: TLS with certificate pinning, HSTS, 802.1X, encrypted VPN tunnels.

DDoS (Distributed Denial of Service)

A botnet of compromised machines floods a target with traffic, exhausting bandwidth, CPU, or connection table entries. Amplification attacks (DNS, NTP, SSDP) let attackers send small requests to open resolvers, which respond with large replies directed at the victim (amplification factor 50–100×). Defences: ingress filtering (BCP 38), rate limiting, CDN/anycast scrubbing, cloud-based DDoS protection services.

VPN

A VPN (Virtual Private Network) creates an encrypted tunnel between two endpoints, making remote devices appear to be on the same private network. Common protocols: IPsec (tunnel/transport mode; widely used in site-to-site VPNs), OpenVPN (TLS-based, UDP or TCP), WireGuard (modern, minimal, very fast). VPNs protect against eavesdropping on untrusted networks but shift trust to the VPN provider.

Zero trust introduction

Traditional security assumed everything inside the corporate network perimeter was trustworthy ("castle-and-moat"). Zero trust (NIST SP 800-207) assumes breach: every access request is verified regardless of network location. Principles: verify identity explicitly (MFA, certificates), use least-privilege access, assume breach and minimise blast radius. Implemented via identity-aware proxies, mTLS service meshes, micro-segmentation, and continuous posture assessment.