Hardening the network you already run. Articles tagged Network Security cover control-plane protection, access control, segmentation, and the attacks each countermeasure is actually stopping.
RA Guard and DHCPv6 Guard stop the loud attacks: rogue routers and rogue DHCP servers. But there is a quieter layer of IPv6 abuse that operates below them, at the level of individual addresses. A host that spoofs its neighbor&
In IPv4, a rogue DHCP server is a nuisance you can contain with DHCP snooping. In IPv6, the equivalent threat is worse and easier to trigger, because IPv6 hosts configure themselves from Router Advertisements, and any device on the segment
Source IP addresses are trivially forged. Nothing in the IP header proves the source is who it claims to be, and a packet with a lie in the source field is the raw material for reflection attacks, spoofed floods, and
Every router has a CPU, and that CPU is a shared, finite resource that both keeps the network running (OSPF hellos, BGP updates, your SSH session) and can be trivially overwhelmed by traffic aimed at it. A flood of pings
The moment more than one person can log into your routers, you have an access-control problem. Who is allowed in? What are they allowed to do once they are in? And can you prove, after the fact, who typed
Every network device ships with the same weakness: a login prompt that will accept a guessed password forever unless you tell it not to. Hardening that prompt is a CCNA domain 5 objective and a real-world necessity, and it
CCNA domain 5 opens with a set of definitions that sound interchangeable but are not: threat, vulnerability, exploit, mitigation. The exam tests whether you can keep them straight, and the real world punishes you when you can't, because
A scan you cannot reproduce is a story, not evidence. The moment an Nmap result matters - a firewall change you signed off on, a rogue service you found on a production VLAN, an asset inventory the audit team will lean
Timing is the lever that decides whether an Nmap scan finishes before your coffee gets cold or runs so slowly it slips under an intrusion-detection sensor. When you are sweeping a /16 for an asset inventory, you want every
Nmap ships a whole family of options with names like fragmentation, decoys, and source-port spoofing, and it is easy to read that list as an attacker's cheat sheet. Flip the framing. As the engineer who owns the
By the time you have found an open port and identified the service behind it, you have answered "what is listening here?" but not "what can it tell me about itself?" That second question is where
Most people scan TCP, get their results in seconds, and stop there. But a huge amount of what runs on a real network lives on UDP: DNS, DHCP, SNMP, NTP, TFTP, IKE. If you only ever scan TCP, you are