Sniffing, Session Hijacking and DoS Attacks

• Network sniffing and traffic analysis
• Session hijacking
• Denial of service (DoS)
• Distributed denial of service (DDoS) attacks
• Botnets

q Active sniffing is used to capture network traffic in switched LAN environments by

actively injecting packets into the network. Unlike hub-based networks, where data is broadcast to all devices, switches forward packets only to the intended destination based on MAC addresses. As a result, passive sniffing is ineffective in switched networks.

q To overcome this limitation, attackers use active techniques such as ARP spoofing

or MAC flooding to manipulate traffic and redirect it through their system. Switches rely on a Content Addressable Memory (CAM) table, which maps MAC addresses to specific ports. By exploiting this mechanism, an attacker can intercept traffic that would not normally be accessible.

q A sniffer can then capture and analyze packets, potentially exposing sensitive

information such as credentials or confidential data

Passive Sniffing: Passive sniffing is very difficult to detect because it does not generate additional network traffic. Detection is possible only through advanced techniques such as:

• Monitoring NIC mode: Identifying network interfaces running in promiscuous mode using specialized tools (rarely performed in practice)
• Analyzing host performance: Unusual CPU or disk usage may indicate packet capture activity, though this method is indirect and unreliable

Active Sniffing: Active sniffing is easier to detect than passive sniffing because it introduces abnormal traffic into the network. Security systems such as Intrusion Detection Systems (IDS) can identify signs of attack, including:

• Unusual ARP traffic: Large numbers of ARP replies without corresponding requests or inconsistent IP-to-MAC mappings
• MAC address flapping: A MAC address appearing on multiple switch ports in a short time
• Duplicate IP addresses: Network conflicts caused by spoofed ARP responses

Purpose:

• Resolves IP addresses to MAC addresses
• Enables communication within a local network (LAN)
• Bridges the Network Layer (IP) and Data Link Layer (MAC)

How It Works:

1. The host checks its ARP cache for an existing mapping
2. If not found, it broadcasts an ARP Request: → “Who has IP X.X.X.X?”
3. The target host replies with an ARP Reply (unicast): → “IP X.X.X.X is at MAC XX:XX:XX:XX:XX:XX”
4. The mapping is stored in the ARP cache (duration varies by OS)

Key Characteristics:

• Stateless protocol: no session or verification mechanism
• No authentication: replies are automatically trusted → vulnerable to spoofing
• Local scope only: operates within a LAN (does not cross routers)
• Broadcast/Unicast behavior:
  • Requests → broadcast
  • Replies → unicast

Port Security Definition:

• Port security is a switch feature that restricts access to a port by limiting the MAC addresses
• allowed to connect. When enabled, the switch forwards traffic only from authorized MAC addresses.

Security Violation Conditions occur: q When a port is configured as secure and the maximum number of secure MAC addresses is

reached.

q When a machine's MAC address attempting to access the port does not match any identified

secure MAC addresses.

Methods for Configuring Secure MAC Addresses: ü Manually configure all secure MAC addresses using the switch port port-security mac-

address command.

ü Allow the port to dynamically learn and configure secure MAC addresses from connected

devices.

ü Configure a specific number of addresses manually and allow the remainder to be

dynamically learned.

Benefits of Port Security:

• Limits MAC flooding attacks.
• Locks down ports to authorized devices only.
• Sends SNMP traps for security monitoring and alerts.

• Definition : ARP poisoning is a cyberattack in which an attacker sends forged ARP messages onto a local network to manipulate ARP tables (ARP cache) of other devices.
• Primary Primary Goal: To associate the attacker’s MAC address with the IP address of a legitimate device (e.g., the default gateway or another host)
• Result: Once successful, network traffic is redirected through the attacker’s machine, enabling them to:
• Intercept and steal data (Man-in-the-Middle attack)
• Launch Denial-of-Service (DoS) attacks
• Perform session hijacking

• Step 1: Reconnaissance
  • The attacker identifies the IP addresses of:
  • The target victim
  • The default gateway
• Step 2: The Poisoning
  • The attacker sends forged ARP replies:

To the victim:

→ “I am the gateway. My MAC address is [Attacker’s MAC].” To the gateway:

→ “I am the victim. My MAC address is [Attacker’s MAC].”

• These fake replies are sent continuously to maintain the attack.

• Step 3: The Redirection
  • Both the victim and the gateway update their ARP caches with false mappings
  • Traffic between them is now redirected through the attacker’s machine
• Step 4: The Attack
  • Sniff (capture sensitive data)
  • Modify (alter packets in transit)

The Core Vulnerability: ARP is a Trust-Based Protocol

• No Authentication: Devices automatically trust ARP replies without verifying their legitimacy.
• Stateless Behavior: Devices accept ARP replies even if they did not send a request (unsolicited responses)
• No Integrity Verification: There is no mechanism to validate that the IP–MAC mapping is correct
• Result:This lack of security allows attackers to inject forged ARP replies and poison ARP caches, enabling traffic interception and Man-in-the-Middle attacks.

1. Encryption (Mitigation, not prevention)

• Use a VPN (Virtual Private Network)
• Encrypts traffic, making intercepted data unreadable to attackers
• Does not stop ARP spoofing, but reduces its impact

2. Static ARP Entries

• Manually bind IP addresses to MAC addresses
• Prevents devices from accepting fake ARP replies
• Limitation: Not scalable for large networks

3. Packet Filtering & Monitoring

• Use IDS/IPS systems to detect abnormal ARP activity

Identify:

• Conflicting IP–MAC mappings
• Suspicious ARP traffic patterns

• Block malicious packets before they reach hosts

1. Dynamic ARP Inspection (DAI)

• Validates ARP packets using the DHCP Snooping binding table
• Drops invalid or spoofed ARP packets
• One of the most effective network-level defenses

1. Security Testing (Penetration Testing)

• Perform controlled ARP spoofing tests to evaluate defenses
• Identify vulnerabilities and improve security measures

Stealing:

Attackers use different techniques to steal session IDs.

• An attacker can steal the session key through physical access by, for example, acquiring the files containing session IDs or memory contents of either the user’s system or the server.
• The attacker can also use sniffing tools such as Wireshark or SteelCentral Packet Analyzer to sniff the traffic between the client and server to extract the session IDs from the packets.

Guessing:

An attacker attempts to guess the session IDs by observing session variables. In the case of session hijacking, the range of session ID values that can be guessed is limited. Thus, guessing techniques are effective only when servers use weak or flawed session-ID generation mechanisms.

Brute forcing:

In the brute-force technique, an attacker obtains session IDs by attempting all possible permutations of session ID values until finding one that works. An attacker using a digital subscriber line (DSL) can generate up to 1,000 session IDs per second. This technique is most useful when the algorithm that produces session IDs is non-random.

• Session hijacking builds on sniffing techniques
• It involves not only observing traffic but also taking control of an active session
• The attacker targets a session that has already been authenticated
• For a successful attack, the attacker must identify a valid and active session

This is challenging due to:

ü Network segmentation ü Switched networks ü Encryption mechanisms

• Sequence number facts:
  • TCP sequence numbers are 32-bit values

→ Over 4 billion possible combinations

• They ensure packets are:
• Ordered correctly
• Reassembled properly at the destination

To hijack a TCP session, the attacker must:

Predict or obtain valid sequence numbers

• Sequence number prediction: q A TCP session begins with the 3-way handshake: 1) Client → Server: SYN Server → Client: SYN/ACK 2) Client → Server: ACK 3) q During this process:
  • Each side selects an Initial Sequence Number (ISN)
  • Modern systems use pseudo-random ISNs q If sequence numbers are predictable:

ü

The attacker can forge packets

ü

Establish a connection using a spoofed IP address

ü

Potentially hijack the session

• Denial-of-service (DoS) is an attack that prevents authorized users from accessing a computer or network.
• DoS attacks target the network bandwidth or connectivity.
• Bandwidth attacks overflow the network with a high volume of traffic using existing network resources, thus depriving legitimate users of these resources.
• Connectivity attacks overflow a computer with a large amount of connection requests, consuming all available operating system resources, so that the computer cannot process legitimate user requests.

There are seven kinds of techniques that are used by the attacker to perform DOS attacks on a computer or a network.

flood

• Smurf attack — Carried out when a large amount of traffic is directed to the broadcast address of a network instead of to a specific system; because the attacker configures the packet with the intended victim as the source, all hosts on the network respond to the victim instead of to the attack
• Ping flood — Carried out by sending a large number of ping packets to the victim with the intent of overwhelming the victim; very simple attack

• A distributed denial-of-service (DDoS) attack involves a multitude of compromised systems attacking a single target, thereby causing denial of service for users of the targeted system.
• To launch a DDoS attack, an attacker uses botnets and attacks a single system.

• Network sniffing and traffic analysis
• Session hijacking
• Denial of service (DoS)
• Distributed denial of service (DDoS) attacks
• Botnets