Last updated: May 1, 2026
A “protocol” is just an agreed format for messages between two machines. The trouble is that most of the protocols still keeping the Internet running were designed in an era of trust — the campus LAN at MIT in 1982, the early ARPANET, where everyone knew everyone. None of the original specs imagined adversaries. ARP, DHCP, ICMP, DNS, NTP — every one of them has been weaponised, and yet they still run unauthenticated on most networks because the alternative is too disruptive. This module walks through each protocol the way an attacker reads it: what does it assume, where does the trust break, and what does a defender do?
ARP — the protocol that has no security at all
Address Resolution Protocol maps Layer 3 (IP) to Layer 2 (MAC) on a LAN. Host A wants to send to 192.168.1.1; A broadcasts an ARP request “who has 192.168.1.1?”; the holder replies “I do, my MAC is aa:bb:cc:dd:ee:ff.” That reply is unauthenticated, untimestamped, and cached for minutes. ARP poisoning works by simply replying first or replying repeatedly, claiming you are the gateway. The victim now sends all off-LAN traffic to you. Every Layer 2 MITM tool — Ettercap, bettercap, Cain and Abel from the old days — is just an ARP poisoner with a TLS-stripping front-end.
DefencesDynamic ARP Inspection (DAI) on managed switches, Static ARP entries on critical hosts, and 802.1X with MACsec for high-trust environments. Most enterprises run none of these and rely on “the LAN is trusted” — a 1990s assumption that BYOD and IoT devices have made indefensible.
Custom team training + practitioner advisory
Beyond the free academy — we run private workshops, vCISO advisory, and red-team exercises tailored to your stack. For Indian SMBs scaling past their first hire.