Networking is often seen as simple router and switch configuration. Yet as soon as you start manipulating packets, you realize it's much more than that: it's a universal language. I recently dove into two fundamental exercises to understand how the network works... and how it can be hijacked.
The offensive: Understanding ARP Spoofing
It all starts with a simple truth: the ARP protocol, which links IP addresses to MAC addresses, is based on blind trust. It doesn't verify who responds to an ARP request.
That's the flaw I explored by simulating a "Man-in-the-Middle" (MitM) attack. Using a GNS3 topology and a Kali Linux container, the goal was simple: make two machines (VPC1 and VPC2) believe my interface was their legitimate neighbor.
By enabling IP Forwarding on Kali, I was able to intercept the traffic without interrupting the communication. The result is glaring: the victims' ARP tables were corrupted, redirecting traffic to my attacking interface.
The lesson: Layer 2 (data link layer) security is fragile. Without defense mechanisms (like DAI - Dynamic ARP Inspection), a local network is vulnerable by nature.
The defense: BGP dissection and Quality of Service
If ARP Spoofing shows us the network's fragility, BGP (Border Gateway Protocol) analysis shows us its robustness. BGP is the protocol that holds the Internet together. But how do you know what's really happening under the hood?
By analyzing a .pcap file with Wireshark, I was able to break down the key steps of a routing session:
OPEN: The initial handshake.
KEEPALIVE: The heartbeat that keeps the session alive.
UPDATE: The crucial moment where IP prefixes (NLRI) and paths (AS_PATH) are exchanged.
I also explored Quality of Service (QoS). Why is BGP so critical? Because it's often marked with a DSCP CS6 (Network Control) field. By comparing packets, I could see the difference between standard traffic (CS0) and priority traffic.
Conclusion: Why does this duality matter?
You can't be a good defender without understanding attack techniques. Mastering ARP Spoofing helps you better secure local access. Mastering BGP analysis helps you better diagnose large-scale routing problems.
The network isn't a black box. With the right tools — GNS3 for simulation and Wireshark for analysis — everything becomes visible.
What about you, what's the next step in your network exploration?