How to recognize denial-of-service, spoofing, rogue infrastructure, wireless, and social-engineering attack paths.
Network attacks abuse availability, trust, identity, configuration, or human behavior. Classifying the attack path before selecting a control helps an operator gather appropriate evidence and contain the correct boundary.
| Attack class | Characteristic behavior | Defensive focus |
|---|---|---|
| Denial of service (DoS/DDoS) | Capacity or state is exhausted so legitimate use is degraded or unavailable | Rate limiting, resilient architecture, upstream protection, monitoring, and incident coordination |
| Spoofing | An actor presents a false address, identity, or service | Authentication, validation, binding/inspection controls where applicable, and anomaly detection |
| On-path attack | Traffic is intercepted or altered through an attacker-controlled position | Encryption, certificate validation, secure switching and routing controls, and path monitoring |
| Rogue service or device | An unauthorized DHCP server, DNS server, access point, or other infrastructure appears | Inventory, admission control, segmentation, wireless monitoring, and port security |
| Wireless impersonation | A rogue AP or evil twin imitates a trusted wireless network | Strong authentication, secure client configuration, wireless monitoring, and user awareness |
| Social engineering | Human trust is used to obtain access, credentials, or information | Verification procedures, least privilege, training, and reporting paths |
An evil twin is a rogue wireless access point that impersonates a legitimate network. A rogue AP is an unauthorized access point; it may or may not imitate an existing SSID. An on-path attack, sometimes called a man-in-the-middle attack, places the attacker between communicating parties to observe or manipulate traffic.
1Unexpected ARP mapping for the default gateway
2→ investigate a possible spoofing or on-path condition
3
4Public service becomes unreachable under abnormal traffic volume
5→ investigate an availability attack and capacity exhaustion
6
7Clients receive an unexpected gateway or DNS server
8→ investigate a rogue DHCP service or configuration problem
The same symptom can have a non-malicious cause, so classification is a working hypothesis rather than proof. Preserve relevant logs and telemetry, verify the asset inventory and change history, and follow the organization’s incident process before making broad changes.
For boundaries that reduce lateral movement when a device or user is compromised, see Network Segmentation for Guest, BYOD, IoT, and OT.