Chapter 38 — Security basics
The uncomfortable truth
TCP/IP was designed in the 1970s for a small network of trusted research institutions. Security was explicitly a low priority. Almost every security problem you'll meet comes from that decision, and every fix is bolted on.
The attacks worth understanding
| Attack | How it works | Defence |
|---|---|---|
| Eavesdropping | Anyone on the path reads your traffic (you saw this with tcpdump -A in Chapter 28) |
Encrypt everything — TLS, SSH, VPN |
| ARP spoofing | Attacker on your LAN claims to be the router (Chapter 6 — ARP has no authentication) | Dynamic ARP Inspection on switches; encryption makes it useless |
| DNS spoofing/poisoning | Attacker gets you a fake answer, sending you to their server | DNSSEC, DoT/DoH, TLS certificate checks catch it |
| SYN flood | Thousands of SYNs, never completed, filling the server's half-open table (Chapter 21) | SYN cookies (on by default in Linux) |
| DDoS | Overwhelm with traffic from many sources | Upstream scrubbing/CDN — you cannot absorb it yourself |
| Man-in-the-middle | Attacker sits in the path and relays/modifies | TLS with certificate validation — this is why the browser warning matters |
| Port scanning | Probing to find open services | Firewall, close unused ports, monitor |
| Amplification | Small spoofed request to a service that sends a huge reply to the victim | Don't run open DNS/NTP resolvers; source-address filtering (BCP 38) |
Firewalls
A firewall decides which packets to allow. Three generations:
- Stateless (packet filter) — checks each packet's addresses/ports independently. Simple, but you have to open return traffic manually.
- Stateful — tracks connections. "Allow new outbound, allow established return traffic." This is what everything uses now.
- Application-aware (NGFW/WAF) — also inspects HTTP content, blocks SQL injection, etc.
The one rule: DROP (silently discard) vs REJECT (send back a refusal).
DROP makes attackers wait and reveals less; REJECT is friendlier for debugging
internal services. This is exactly the timeout-vs-refused distinction from
Chapter 21 — now you know why you see one or the other.
A sane default firewall shape:
INBOUND: default DENY
allow established/related (stateful -- return traffic)
allow loopback
allow ICMP types 3 and 11 <-- do NOT block all ICMP (Ch 14, 15)
allow the specific services you actually run (e.g. 22, 443)
OUTBOUND: usually allow all (tighten in high-security environments)
Practical hygiene
# 1. What is exposed on this machine? (do this on every server you run)
ss -tulnp
# 2. Is the firewall on?
sudo ufw status # Ubuntu
sudo firewall-cmd --state # RHEL/Fedora
sudo iptables -L -n # raw
# macOS: System Settings > Network > Firewall
# 3. Are services bound to 0.0.0.0 that shouldn't be?
ss -tuln | grep '0.0.0.0'
The single highest-value security habit in this guide: run ss -tulnp on any
machine you're responsible for, and for each line ask "should the world be able
to reach that?" Databases bound to 0.0.0.0 with default passwords are how a
huge fraction of breaches begin.
Practice (20 min)
# See plaintext traffic (why TLS exists)
sudo tcpdump -i any -A 'tcp port 80' -c 30 &
curl -s http://example.com > /dev/null
# your request and the response are fully readable
# Compare with HTTPS
sudo tcpdump -i any -A 'tcp port 443 and host example.com' -c 30 &
curl -s https://example.com > /dev/null
# handshake visible; content is gibberish
# Audit your own machine
ss -tulnp
Further reading
- Course (free): Professor Messer's CompTIA Security+ videos — solid, vendor-neutral network security fundamentals.
- Book: Practical Packet Analysis has a good security-analysis chapter.
- Site: OWASP (owasp.org) for application-layer security; the OWASP Top 10 is essential reading for anyone building web services.
- Practice (legal!): TryHackMe or HackTheBox — hands-on labs you're allowed to attack. Never practise on systems you don't own.