Helpful first: Networks in one request: DNS, TCP, TLS, and HTTP · Three packets to open a road: TCP SYN, SYN-ACK, and ACK
Key points
- Map the 7 OSI layers to their Protocol Data Units (Bits, Frames, Packets, Segments/Datagrams, Data), addressing, and TCP/IP equivalents
- Diagnose Layer 2 attacks (ARP spoofing, MAC flooding/CAM table overflow, VLAN hopping) and apply 802.1X, Dynamic ARP Inspection (DAI), and port security
- Compare Layer 3/4/7 attacks (ICMP Smurf/Fraggle, Teardrop fragmentation, TCP SYN flood, DNS cache poisoning) and their protocol defenses
The 7 OSI layers, 4 TCP/IP layers, and PDU encapsulation
As a message travels down the networking stack from an application to the physical wire, each layer wraps the payload above it with its own header (and at Layer 2, a Frame Check Sequence trailer). This wrapping process is called Encapsulation, and the named unit at each layer is the Protocol Data Unit (PDU).
At Layers 7, 6, and 5 (Application, Presentation, and Session - combined into the Application layer in the 4-layer TCP/IP model), the PDU is simply Data. At Layer 4 (Transport), TCP wraps the data into a Segment (adding source/destination ports, sequence numbers, and window size for reliable flow control) or UDP wraps it into a connectionless Datagram. At Layer 3 (Network / Internet), IP wraps the segment into a Packet with logical source and destination IPv4 or IPv6 addresses for routing across subnets.
At Layer 2 (Data Link), Ethernet or 802.11 Wi-Fi wraps the packet into a Frame addressed to the physical hardware MAC address of the next local hop. Finally, at Layer 1 (Physical), transceivers convert the frame into electrical, optical, or radio Bits on the medium.
| OSI Layer | PDU & Addressing | Protocols & Devices | Classic Attacks & Controls |
|---|---|---|---|
| 7. Application / 6. Presentation / 5. Session | Data (Hostnames, URIs, Sessions) | HTTP, DNS, SMTP, SSH, TLS, UTF-8, RPC | SQLi, XSS, DNS poisoning, CSRF -> WAF, DNSSEC, input validation, mTLS. |
| 4. Transport | Segment (TCP) / Datagram (UDP) (Ports 0-65535) | TCP, UDP, QUIC, Stateful Firewall / Load Balancer | SYN flood, UDP Fraggle flood, port scan -> SYN cookies, stateful firewall. |
| 3. Network | Packet (Logical IPv4 / IPv6 address) | IP, ICMP, IPsec, OSPF, BGP, Routers | ICMP Smurf flood, IP spoofing, Teardrop, BGP hijack -> BGP RPKI, BCP 38 egress filtering, IPsec. |
| 2. Data Link | Frame (48-bit Physical MAC address) | Ethernet, 802.1Q VLAN, ARP, PPP, Switches | ARP spoofing, MAC flooding, VLAN hopping, STP manipulation -> 802.1X, DAI, DHCP Snooping, Port Security, BPDU Guard. |
| 1. Physical | Bits (Voltage, Light, RF) | Fiber, Cat6, Hubs, Repeaters, Transceivers | Wiretapping, RF jamming, rogue taps -> Conduit, Faraday shielding, fiber optics. |
Layer 2 LAN attacks: MAC flooding, ARP spoofing, and VLAN hopping
Because Layer 2 switches sit inside the perimeter firewall, local LAN protocols historically trusted every frame on the wire. In a MAC Flooding (CAM Table Overflow) attack, an attacker blasts a switch port with thousands of bogus source MAC addresses until the switch’s fixed-size Content Addressable Memory (CAM) table fills up. Once full, many switches fail open into hub-like behavior, broadcasting unaddressed traffic out of every port where the attacker can sniff it. Defenses include IEEE 802.1X port-based authentication and Switch Port Security (limiting the maximum number of MAC addresses per port).
In ARP Cache Poisoning (ARP Spoofing), an attacker sends unsolicited (gratuitous) ARP replies claiming that the default gateway’s IP address belongs to the attacker’s MAC address, silently placing the attacker in a Man-in-the-Middle position on the local subnet. Kael Cho blocks this by enabling DHCP Snooping (which builds a trusted database of legitimate IP-to-MAC-to-port leases) paired with Dynamic ARP Inspection (DAI, which drops any ARP packet that contradicts the DHCP Snooping binding table).
In VLAN Hopping, an attacker exploits either Dynamic Trunking Protocol (DTP) auto-negotiation to pretend to be a trunk switch, or 802.1Q Double Tagging (attaching an outer tag matching the unencrypted native VLAN and an inner tag targeting a restricted VLAN). Defenses are straightforward: disable auto-trunking (switchport mode access), explicitly prune allowed VLANs, and move the Native VLAN to an unused dummy VLAN ID.
Layer 3, 4, and 7 protocol attacks and defenses
At Layers 3 and 4, classic Denial-of-Service (DoS) attacks abuse spoofing, fragmentation, or broadcast amplification. A Smurf attack sends ICMP Echo Requests (ping) to a network broadcast address with a spoofed source IP set to the victim’s address, causing every host on the subnet to reply simultaneously to the victim (mitigated by disabling directed broadcasts on routers and applying BCP 38 anti-spoofing ingress/egress filtering). A Fraggle attack is identical to Smurf except it uses Layer 4 UDP traffic (ports 7 echo / 19 chargen) instead of Layer 3 ICMP.
Fragmentation attacks such as Ping of Death (oversized >65,535-byte IP packets) and Teardrop (manipulating IP fragment offset fields so fragments overlap during reassembly) targeted legacy OS network stacks and are blocked by modern stateful inspection firewalls that reassemble and validate fragments.
At Layer 7, DNS Cache Poisoning attempts to inject forged DNS resource records into a recursive resolver’s cache so users visiting chronos.orbital are directed to an attacker IP. The definitive cryptographic control for DNS record authenticity and integrity is DNSSEC (Domain Name System Security Extensions), which digitally signs DNS zones (RRSIG, DNSKEY, DS records) - though remember that DNSSEC signs records publicly and does not encrypt DNS queries (use DoH or DoT for query confidentiality).
CHECK YOUR JUDGMENT
An attacker plugs a rogue laptop into a conference-room wall jack at Meridian Space & Robotics (chronos.orbital) and floods the access switch with tens of thousands of Ethernet frames containing random source MAC addresses, attempting to overflow the switch’s CAM table so it broadcasts traffic like a hub. At which OSI layer does this attack occur, and which switch control directly prevents it?
NEXT FIELD LESSON