7 Network Security
What an observer can learn from traffic depends on where they can see it and how it is protected.
Harbour’s booking service depends on several network paths: customers reach the web application, staff use a VPN, and the application queries a database. Some traffic crosses infrastructure the centre does not control. An observer on a path may learn from traffic without compromising either endpoint. This chapter explains those observation limits and how to protect a connection.
7.1 What this chapter covers
By the end you should be able to:
- Explain how scanning and sniffing work and what they reveal.
- Describe what a packet capture shows, and why unencrypted traffic is so revealing.
- Describe common network attacks (spoofing, man-in-the-middle) and their defences.
- Explain why encryption in transit matters, and what segmentation and monitoring add.
7.2 A small network primer
A host is a device or system connected to a network. Its IP address helps route packets to it; a port helps identify a service on that host. A service is a listening application, such as a web server. DNS maps names to addresses. A switch connects devices locally; a router moves traffic between networks. A subnet groups addresses for routing purposes.
A trust boundary is where rules about access or trust change, such as between guest Wi-Fi and staff systems. A line on a drawing does not enforce that boundary: routing, filtering and access controls must implement it.
7.3 The network as an attack surface
Recall the phases of an attack from the first chapter: reconnaissance, then scanning, then gaining access. Networks are where the first two of those live. Before an attacker can exploit a system, they have to find it and learn what it’s running. A network, by its nature, answers questions. Ask a machine “are you there?” and, unless told otherwise, it politely replies. Ask “what services are you running?” and its open ports announce them. Each reachable service adds an exposure to examine. Defaults vary, and a lack of response does not prove a device or service is absent.
7.4 Scanning: mapping the target
Scanning is how an attacker (or a defender auditing their own network) turns a vague target into a map. It usually happens in layers. First, find the live hosts: a sweep that asks every address on a network “are you there?” and notes who answers. Then, for each live host, find the open ports. A port is a numbered doorway, and each open one usually corresponds to a running service (a web server, a file share, a remote-login service). Finally, probe those services to learn which software and version is behind them, because a known version can be matched against known vulnerabilities from the software-security chapter.
The result is a blueprint: here are your machines, here are the doors that are open, here’s the software behind each one. To an attacker, that’s a shopping list. To a defender, the same scan is an audit. That is why the tools are dual-use, and why the defensive instinct is to close the doors you don’t need. Every service you’re not using is a door you can shut, shrinking the blueprint an attacker gets to work from.
10.2.0.0/24; no companion lab is required.
7.5 Sniffing: reading the wire
Scanning finds the doors. Sniffing reads what goes through them. A network interface normally ignores traffic not addressed to it, but put it into a listening (“promiscuous”) mode and it will capture everything it can hear: a packet capture of the raw conversations crossing the wire. A tool can decode supported protocols from the captured packets.
The phrase it can hear matters. On a switched network, another host’s unicast traffic may never reach your capture interface. Promiscuous mode does not make the switch send it there. Wi-Fi capture also depends on the adapter, access-point settings and link protection. Explain the observation point before claiming what a capture reveals. Wireshark’s Ethernet guidance sets out these limits.
One thing lands hardest the first time someone sees it: unencrypted application traffic can expose its contents to a listener at a suitable capture point. Older protocols were designed in a more trusting era and send everything unencrypted: the web’s original HTTP, file transfer with FTP, remote login with Telnet, some email protocols. Capture that traffic and you don’t just see that a conversation happened. You see its contents: the pages requested, the files moved, and the usernames and passwords typed in the clear. This is the sniffing that the authentication chapter warned about, made concrete: the strongest password in the world is worthless if it crosses the network in plain text for anyone listening to read. It is unsettling to witness, and it converts “you should use encryption” from advice into an obvious necessity.
7.6 Attacks in the middle
Listening is passive. Network attacks get more dangerous when the attacker stops observing and starts interfering.
Spoofing is forging an identity on the network: sending traffic that claims to come from an address that isn’t yours. An attacker might spoof a trusted machine’s address to slip past a filter, or forge the source of an attack to hide their tracks. The network’s willingness to believe what packets claim about themselves is the weakness being exploited.
The more powerful move is the man-in-the-middle (or on-path) attack: the attacker positions themselves between two parties, so that everything each side sends passes through them first. If the protocol lacks effective authenticated protection, they may read or alter the conversation: changing a bank account number in transit, injecting malicious content, or capturing credentials as they flow past. Two common techniques get an attacker into that position on a local network. ARP spoofing tricks nearby machines into routing their traffic through the attacker by lying about which hardware address belongs to which machine. DNS spoofing answers a name lookup with the wrong address, so the victim connects to the attacker’s server while believing it’s the real one. The details matter less than the shape: the attacker exploits the small, trusting mechanisms that make a network convenient, and turns them into a wiretap.
7.7 Why the local attacker is special
Notice that ARP spoofing and casual sniffing both require the attacker to be on the same network. This is why an attacker who has gained a foothold on your local network, or who is sharing the coffee-shop Wi-Fi, can do things a purely remote attacker cannot. They can hear the local chatter, impersonate local machines, and slip into the middle of local conversations in ways that someone out on the wider internet, several routers away, cannot manage. It’s a concrete reason the inside of a network can never be treated as automatically safe. This is the assume-breach mindset applied to your own LAN.
7.8 Defences: making the wire private again
The good news is that the central weakness, traffic readable by anyone listening, has a decisive fix, and you already met it.
Encryption in transit is the answer to sniffing. When traffic is encrypted (the web’s HTTPS, which is HTTP wrapped in the TLS scheme from the cryptography chapter), an eavesdropper still captures the packets but sees only unreadable ciphertext. The credentials, the page contents, the files: all gibberish to anyone without the key. It protects the encrypted contents, but packet timing, sizes and some addressing information remain observable. Protocol and configuration choices determine what else is visible. TLS must also authenticate the intended endpoint to resist an active impostor; ignoring certificate errors undermines that check. That is why the migration of the web from HTTP to HTTPS was one of the most important security improvements of the last decade, and why sending anything sensitive over an unencrypted protocol is now indefensible.
Two more layers back it up. Segmentation divides a network into zones with controlled routes between them, so that a foothold in one part doesn’t grant free movement across the whole. It’s the same idea that starves a worm (from the malware chapter) and contains an incident (from the planning chapter). Monitoring watches network traffic for the tell-tale signs of trouble (a host scanning its neighbours, traffic to a known-bad address, a volume spike), so that the intrusion you couldn’t prevent is at least detected, feeding straight into the incident response of the previous chapter. Encryption hides the contents, segmentation limits the movement, and monitoring catches what gets through. No single one is enough.
Incident Zero’s Network Building module makes you buy an architecture you can’t fully afford, and the gaps you leave come back to bite in later rounds. It’s a quick, concrete lesson in why security is a budget problem as much as a technical one. → incidentzero.retroverse.studio
7.9 Where this connects
The credentials a sniffer harvests are the ones authentication taught you to protect, and encryption in transit is what stops them leaking. That encryption is the hybrid TLS scheme from cryptography, in action. And the next chapter, VPN and firewalls, covers the two defences that build on this one: a firewall to control what traffic is allowed, and a VPN to protect traffic within its configured tunnel.
7.10 Questions to consider
- Name one everyday thing you do online that would be visible in plaintext to someone sniffing the network, and one that wouldn’t. What’s the difference between them?
- Why can an attacker on the same network do things a purely remote attacker can’t?
- Imagine you captured your own device’s traffic for one minute. What do you think you’d be able to read, and what would be hidden? What does that difference tell you about how you should send sensitive information?
7.11 State what an observer can see
In 10 minutes, draw Harbour’s public, staff, guest and database boundaries. For a passive observer at the guest access point, distinguish encrypted content from routing/timing information and unknown visibility. Do not assume the observer receives every staff packet. Name a boundary test you would request from an authorised administrator; do not run it yourself.
Case inputs and checks: Harbour dossier.