Security+ 801 Countdown, T-26: Network and Physical Attacks, With Sniffing In and Bollards Out

Most of what an attacker does on a network leaves a trace a defender can read in a packet capture, and most of what an intruder does to a building leaves a trace a defender can find on a walk around it. SY0-801 objective 2.5, “Given a scenario, analyze indicators of malicious activity,” expands the network attack list to include rogue, sniffing, spoofing, and cache poisoning, and introduces a physical attack list of tailgating, shoulder surfing, skimming, and forced entry (CompTIA 2025). The full network list is DDoS, protocol downgrade, rogue, sniffing, spoofing, on-path, DNS attacks, and cache poisoning.

Both lists exist because an analyst’s job is to name an attack from its evidence. A capture shows a reply that answers no request; a resolver starts handing every client the wrong address; a fuel pump’s tamper seal reads “void”; a stranger walks in behind a badge holder. Each is an indicator, and each maps to one named attack and one or two named controls. This post takes the network attacks first, then the physical attacks, and closes with the physical-based and signal-based threat vectors that objective 2.3 lists alongside them.

Sniffing, spoofing, and the on-path position

Three of the network attacks form a single chain. Sniffing is passive capture: the attacker reads traffic without sending any. Spoofing is a forged identity: the attacker sends a frame, packet, or reply that claims to come from someone else (an ARP reply, a MAC or IP address, a DNS answer, or a DHCP offer). On-path is the position a successful spoof buys: the attacker sits between two parties so their traffic passes through a host the attacker controls. When I teach this in ITN 260, I treat them as one chain and ask which link the stem shows.

Sniffing on a switched network

Sniffing uses promiscuous mode, a SPAN port, or cloud traffic mirroring (MITRE ATT&CK 2026). Promiscuous mode tells a network interface to pass every frame it receives up to the host, not only the frames addressed to it; a SPAN or mirror port is a switch port that receives copies of other ports’ traffic. Both are needed because a switch delivers only a host’s own, broadcast, and flooded frames, so capturing other hosts’ unicast traffic needs a mirror port or a spoofing step. NIST SP 800-153 notes that passive attacks transmit nothing, leaving “nothing for an organization to monitor electronically” (Souppaya and Scarfone 2012). You cannot detect what sends nothing, so encryption is the control.

ARP spoofing: how the on-path position is taken

The Address Resolution Protocol (ARP) maps an IPv4 address to a MAC address on the local link: a host broadcasts a request asking who holds an address, the holder replies, and the asker caches the pairing. ARP spoofing exploits RFC 826: a host that already has the sender’s IP cached overwrites the stored MAC before it even checks the opcode, with no authentication (Plummer 1982). Any host can therefore claim the gateway’s address, and every host that hears the claim sends its outbound traffic to the impostor. To get on-path, the attacker poisons both directions, re-sends because entries age out, and forwards traffic so nothing breaks (MITRE ATT&CK 2025).

A tcpdump 4.99.1 decode of synthetic frames shows the whole sequence (192.0.2.1 is the gateway, .10 the victim, MAC :66 the attacker):

$ tcpdump -e -nn -r arp-poison.pcap
09:00:00.100000 00:00:5e:00:53:0a > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Request who-has 192.0.2.1 tell 192.0.2.10, length 46
09:00:00.100912 00:00:5e:00:53:01 > 00:00:5e:00:53:0a, ethertype ARP (0x0806), length 60: Reply 192.0.2.1 is-at 00:00:5e:00:53:01, length 46
09:00:05.000000 00:00:5e:00:53:66 > 00:00:5e:00:53:0a, ethertype ARP (0x0806), length 60: Reply 192.0.2.1 is-at 00:00:5e:00:53:66, length 46
09:00:05.000210 00:00:5e:00:53:66 > 00:00:5e:00:53:01, ethertype ARP (0x0806), length 60: Reply 192.0.2.10 is-at 00:00:5e:00:53:66, length 46
09:00:07.000000 00:00:5e:00:53:66 > 00:00:5e:00:53:0a, ethertype ARP (0x0806), length 60: Reply 192.0.2.1 is-at 00:00:5e:00:53:66, length 46

The first two lines are a normal exchange: the victim asks for the gateway, and the gateway answers from its own MAC, :01. The attacker then answers a question nobody asked, in both directions, and repeats the claim two seconds later. The indicators: replies that answer no request, one MAC claiming two IPs, a gateway MAC that changed from :01 to :66, and claims repeating every two seconds. In Wireshark, arp.duplicate-address-detected flags the conflict, and arp.src.proto_ipv4 == 192.0.2.1 && arp.src.hw_mac != 00:00:5e:00:53:01 catches gateway impostors (Wireshark Foundation, n.d.).

Stopping it at the switch

The switch-side fix is DHCP snooping plus dynamic ARP inspection (DAI). Snooping drops DHCP offers on untrusted ports and builds a binding table of which IP and MAC pair was leased on which port; DAI drops any ARP whose sender IP and MAC pair is not in it (Cisco, n.d.):

ip dhcp snooping
ip dhcp snooping vlan 10
ip arp inspection vlan 10
ip arp inspection validate src-mac dst-mac ip
interface GigabitEthernet1/0/48
 ip dhcp snooping trust
 ip arp inspection trust

Only the uplink toward the real DHCP server is trusted; by default, an untrusted port exceeding 15 ARP packets per second is error-disabled. Static-IP hosts never appear in the snooping table, so they need an ARP ACL or they lose connectivity. The same snooping also blunts the rogue DHCP server described below, since offers on untrusted ports are dropped.

Poisoned caches, downgraded protocols, and rogue infrastructure

The remaining network attacks share a theme with ARP spoofing: each abuses a point where a protocol trusts an answer it cannot verify.

Cache poisoning

A cache is where a protocol stores an answer so it does not have to ask again: an ARP table holds IP-to-MAC pairs, and a recursive DNS resolver holds name-to-address records until their time to live (TTL) expires. Cache poisoning plants a forged answer in that store so every later lookup returns the attacker’s value. The objective says “Cache poisoning” with no qualifier and lists DNS attacks separately, so the likeliest reading covers ARP and DNS caches alike (interpretation).

DNS poisoning is the harder of the two because the attacker is usually off-path. Off-path DNS poisoning races forged answers at a resolver, matching the 16-bit transaction ID, the UDP source port, and the question (Hubert and van Mook 2009); the resolver accepts whichever matching answer arrives first. With fixed ports that took about 32,768 guesses on average; Kaminsky’s 2008 technique (CVE-2008-1447) made the race repeatable, and CERT called multiple outstanding identical queries a “birthday attack” (CERT Coordination Center 2008). Port randomization adds about 16 bits, but only DNSSEC validation authenticates the data, and it offers no confidentiality or DoS protection (Arends et al. 2005). The blast radius differs too: a poisoned resolver misleads every client until the TTL expires; ARP poisoning misleads one broadcast domain.

Protocol downgrade and SSL stripping

A protocol downgrade keeps TLS but forces an older version or a weaker cipher than both parties could have used. SSL stripping removes TLS entirely: an on-path attacker intercepts the first plain-HTTP request and rewrites https links, so no certificate warning appears (Marlinspike 2009). In a capture, a downgrade still shows a TLS handshake, just a worse one; stripping shows plain HTTP where HTTPS should be.

The defenses differ as well. HTTP Strict Transport Security (HSTS) is a response header that tells a browser to use HTTPS only for that host; it defeats stripping after the first secure visit, and a browser’s preloaded HSTS list closes the first-visit gap (Hodges, Jackson, and Barth 2012). Against version rollback, TLS 1.3 builds a sentinel into the handshake: a TLS 1.3 server that negotiates TLS 1.2 must end ServerHello.random with 44 4F 57 4E 47 52 44 01 (ASCII “DOWNGRD” plus 01), and a 1.3 client that sees it must abort (Rescorla 2018). A client that offered 1.3 thereby learns its offer was removed in transit. RFC 8996 forbids TLS 1.0 and 1.1 and marks TLS_FALLBACK_SCSV obsolete, so SCSV is POODLE-era history (Moriarty and Farrell 2021).

Rogue access points and rogue DHCP

“Rogue” has no CompTIA definition, so any reading is interpretation. Three readings have primary sources. A rogue access point (AP) is one made to look like part of the WLAN, a backdoor around the firewall (Souppaya and Scarfone 2012). An evil twin copies the SSID and harvests credentials through a captive portal (MITRE ATT&CK 2024). A rogue DHCP server answers lease requests with attacker-controlled DNS or gateway addresses, so clients route through the attacker without a single forged ARP frame (MITRE ATT&CK, n.d.).

The distinction from objective 2.4’s “Rogue devices” (T-29) is exposure versus behavior. A rogue device is “An unauthorized node on a network” (NIST, n.d.), an entry in the attack surface; the 2.5 cue is what the node does, such as an uninventoried BSSID broadcasting your SSID.

Distributed denial of service

A distributed denial-of-service (DDoS) attack exhausts a target’s bandwidth, connection state, or application capacity with traffic from many sources at once. The objective lists DDoS as a single item, but two mechanisms inside it are worth knowing by name. Reflection spoofs the victim’s IP so third parties answer the victim; amplification makes each answer larger than the query, 556.9 times for NTP (CISA 2014). The CISA, FBI, and MS-ISAC guide sorts floods into volumetric, protocol (layers 3 and 4), and application-layer (layer 7) types (CISA, FBI, and MS-ISAC 2024).

Physical attacks: tailgating, shoulder surfing, skimming, and forced entry

The physical attack list is short, and each entry is defined by what an observer would see. Tailgating is following a badge holder through a controlled door before it closes. Shoulder surfing is watching a screen or a PIN entry. Skimming is capturing card data with a device added to a legitimate reader. Forced entry is breaking into a facility through the barrier itself: a pried door or a rammed entrance.

SY0-801 2.5 attack	Stem cue	Countermeasures
Tailgating	Follows a badge holder through a door	Access vestibule, guards, anti-passback
Shoulder surfing	Watches a screen or PIN entry	Privacy screens, keypad shrouds
Skimming	Loose overlay, raised PIN pad, void seal	Inspection, tamper seals, chip and contactless
Forced entry	Pried door, rammed entrance	Bollards, fencing, lighting, intrusion sensors

Two distinctions matter. By convention, not a standard, tailgating lacks the badge holder’s consent and piggybacking has it; SY0-801 lists only tailgating. Forced entry is a physical breach; do not map it onto brute force, which SY0-801 lists only under Credential attacks, where it means password guessing. The controls in the table’s last column live elsewhere in the objectives: the 1.1 Physical/environmental control category (T-36), 4.8’s surveillance footage and physical access logs (T-8), and the 5.1 Physical security standard (T-7).

Skimming deserves the most attention because the device is designed not to be seen. Deep-insert ATM skimmers are “usually impossible to detect from the ATM’s exterior” and pair with pin-hole cameras, while POS overlays cover the terminal top or just the keypad and chip slot (U.S. Secret Service, n.d.). The pin-hole camera is the shoulder surfer’s mechanical stand-in: the skimmer takes the card data and the camera takes the PIN. Detection therefore depends on routine. The FTC advises serial-tracked pump seals that read “void” when broken (Tressler 2017), and PCI DSS Requirement 9.5 requires a device list, periodic tamper inspection, and staff training for card-present point-of-interaction (POI) devices, the terminals where a card is presented (PCI SSC, n.d.).

Physical-based and signal-based threat vectors

Objective 2.5 lists the attacks; objective 2.3, “Describe threat vectors and sources,” lists the routes by which an attacker reaches a target, and two of its groups belong with the physical attacks above. Physical-based vectors are Lock and key, Access vestibule, and Access passes. An access vestibule is a pair of interlocking doors in which the second opens only after the first has closed, so that one credential admits one person; an access pass is the badge or card the reader checks. My reading of the three: locks are picked or keys copied, vestibules are piggybacked, and passes are cloned, borrowed, or stolen.

Access passes are where card cloning lives. NIST SP 800-116 Rev. 1 says legacy cards “cannot respond to a cryptographic challenge,” a concealed reader can skim a contactless card at “at least 25 cm,” and a passive receiver can sniff the exchange at a reported “about 10 m” (Ferraiolo et al. 2018). A card that cannot answer a challenge can only repeat a fixed identifier, and a fixed identifier can be copied. HID describes the physical twin of protocol downgrade: copying a secure credential onto a legacy Prox or MIFARE Classic card the reader still accepts. Basically, the fix is the TLS fix: disable the legacy mode, and replace unencrypted Wiegand wiring with OSDP Secure Channel (HID Global, n.d.).

Signal-based vectors are Bluetooth, radio frequency (RF), and near-field communications (NFC): routes that need no cable and no door. Bluetooth has three classic attacks with similar names: bluejacking sends unsolicited messages, bluesnarfing steals data, and bluebugging takes command access (Padgette et al. 2017). RF and NFC attacks fall into two families worth telling apart. A replay attack resends captured data later: a 2018 Honda Civic key fob “sends the same RF signal for each door-open request” (CVE-2022-27254; NIST 2022), so one recording is a working key. A relay attack forwards a live exchange between a card and a reader that are nowhere near each other: ESET’s NGate, reported August 22, 2024, relayed Czech bank customers’ cards via their own phones to an attacker’s phone emulating them at ATMs (Stefanko and Osmani 2024). The difference decides the defense. Relay defeats one-time cryptograms, because the genuine card answers the genuine challenge in real time; replay does not, because a recorded answer no longer matches a fresh challenge.

What you need to know for SY0-801

• Sniffing captures, spoofing forges an identity (ARP, MAC, IP, DNS, DHCP), and on-path is the position.
• Unsolicited ARP replies or a changed gateway MAC point to ARP poisoning (snooping plus DAI); a resolver or many redirected users point to DNS cache poisoning (randomization plus DNSSEC).
• Protocol downgrade weakens TLS (1.3 sentinel in ServerHello.random, no TLS 1.0 or 1.1); SSL stripping removes it (HSTS with preload).
• Rogue is undefined by CompTIA: most likely a rogue AP, an evil twin, or a rogue DHCP server.
• DDoS is one item; reflection spoofs the victim’s source address, and amplification makes each reply larger than the query.
• Tailgating follows, shoulder surfing observes, skimming captures card data, and forced entry breaks in.
• Lock and key, access vestibule, and access passes are physical-based vectors; Bluetooth, RF, and NFC are signal-based.
• Replay resends a captured signal later; relay forwards a live one. Relay defeats one-time cryptograms; replay does not.
• Collision and birthday attacks are 701-era vocabulary; SY0-801 names neither, so treat them as likely distractors.
• RFID cloning is 701-era vocabulary; on SY0-801 the same attack lives under the Access passes vector.

Check yourself

These are my own practice questions, written for this post.

1. A capture shows unsolicited ARP replies every two seconds telling a victim that 192.0.2.1 is at 00:00:5e:00:53:66, and telling 192.0.2.1 that the victim is at that MAC. Which attack do the packets show, and which control stops it?

• A. Sniffing; disable the SPAN session.
• B. ARP spoofing for an on-path position; DHCP snooping with DAI.
• C. Rogue DHCP server; DNSSEC validation.
• D. DNS cache poisoning; source-port randomization.

Answer: B. Forged IP-to-MAC claims in both directions are spoofing that puts the attacker on-path; DAI drops ARP that contradicts the snooping bindings. Sniffing follows, but these packets show the spoof.

2. A TLS 1.3-capable browser aborts with an illegal_parameter alert. The server supports TLS 1.3, yet the captured ServerHello negotiated TLS 1.2 with a random value ending in 44 4F 57 4E 47 52 44 01. What did the client most likely detect?

• A. SSL stripping.
• B. Protocol downgrade.
• C. Cache poisoning.
• D. Replay.

Answer: B. The server sets that sentinel when it negotiates TLS 1.2, so a 1.3-capable client knows its 1.3 offer was removed in transit. Stripping would have left no TLS handshake to inspect.

3. During a morning check, an attendant finds pump 4’s serial-numbered seal reads “void” and its card reader bezel sits proud of the panel. Which SY0-801 physical attack is most likely?

• A. Forced entry.
• B. Skimming.
• C. Shoulder surfing.
• D. Tailgating.

Answer: B. The broken seal shows the pump was opened, and the altered reader shows why: to capture card data. Forced entry describes breaching a facility, not tampering with a payment device.

This is T-26 of the Security+ 801 Countdown: one change from SY0-701 to SY0-801 every morning until the new exam launches on November 17, 2026. Tomorrow, T-25: Indicators of Compromise Now Name Hashes, Timestamps, and Log Tampering. New here? Start with T-38: The Blueprint Was Reweighted and Trimmed to 27 Objectives.

References

Arends, Roy, Rob Austein, Matt Larson, Dan Massey, and Scott Rose. 2005. DNS Security Introduction and Requirements. RFC 4033. Internet Engineering Task Force.

CERT Coordination Center. 2008. “Multiple DNS Implementations Vulnerable to Cache Poisoning.” Vulnerability Note VU#800113.

CISA (Cybersecurity and Infrastructure Security Agency). 2014. “UDP-Based Amplification Attacks.” Alert TA14-017A. Last revised December 18, 2019.

CISA, FBI, and MS-ISAC. 2024. Understanding and Responding to Distributed Denial-of-Service Attacks. Version 2.0.

Cisco. n.d. “Configuring Dynamic ARP Inspection.” Security Configuration Guide, Cisco IOS XE 17.8 (Catalyst 9300 Switches). Accessed October 12, 2026.

CompTIA. 2023. CompTIA Security+ SY0-701 Certification Exam Objectives. Version 5.0.

CompTIA. 2025. CompTIA Security+ SY0-801 V8 Certification Exam Objectives. Document Version 2.0.

Ferraiolo, Hildegard, Ketan Mehta, Nabil Ghadiali, Jason Mohler, Vincent Johnson, and Steven Brady. 2018. Guidelines for the Use of PIV Credentials in Facility Access. NIST Special Publication 800-116 Rev. 1. National Institute of Standards and Technology.

HID Global. n.d. Safeguarding Against Legacy Downgrade Attacks. The PDF metadata shows January 2024.

Hodges, Jeff, Collin Jackson, and Adam Barth. 2012. HTTP Strict Transport Security (HSTS). RFC 6797. Internet Engineering Task Force.

Hubert, Bert, and Remco van Mook. 2009. Measures for Making DNS More Resilient against Forged Answers. RFC 5452. Internet Engineering Task Force.

Marlinspike, Moxie. 2009. “New Tricks For Defeating SSL In Practice.” Presentation slides, Black Hat DC 2009.

MITRE ATT&CK. 2024. “Adversary-in-the-Middle: Evil Twin.” Technique T1557.004.

MITRE ATT&CK. 2025. “Adversary-in-the-Middle: ARP Cache Poisoning.” Technique T1557.002, version 1.1.

MITRE ATT&CK. 2026. “Network Sniffing.” Technique T1040, version 1.7.

MITRE ATT&CK. n.d. “Adversary-in-the-Middle: DHCP Spoofing.” Technique T1557.003. Accessed October 12, 2026.

Moriarty, Kathleen, and Stephen Farrell. 2021. Deprecating TLS 1.0 and TLS 1.1. RFC 8996, BCP 195. Internet Engineering Task Force.

NIST (National Institute of Standards and Technology). 2022. “CVE-2022-27254.” National Vulnerability Database API record.

NIST (National Institute of Standards and Technology). n.d. “Rogue Device.” CSRC Glossary. Accessed October 12, 2026.

Padgette, John, et al. 2017. Guide to Bluetooth Security. NIST Special Publication 800-121 Rev. 2, Update 1 (January 2022). National Institute of Standards and Technology.

PCI SSC (PCI Security Standards Council). n.d. “Are Point-of-Interaction Devices Required to Be Physically Secured, for Example with a Cable or Tether, to Prevent Removal or Substitution to Meet PCI DSS Requirement 9.5?” FAQ. Accessed October 12, 2026.

Plummer, David. 1982. An Ethernet Address Resolution Protocol. RFC 826.

Rescorla, Eric. 2018. The Transport Layer Security (TLS) Protocol Version 1.3. RFC 8446. Internet Engineering Task Force.

Souppaya, Murugiah, and Karen Scarfone. 2012. Guidelines for Securing Wireless Local Area Networks (WLANs). NIST SP 800-153.

Stefanko, Lukas, and Jakub Osmani. 2024. “NGate Android Malware Relays NFC Traffic to Steal Cash.” WeLiveSecurity, ESET, August 22, 2024.

Tressler, Colleen. 2017. “Best Practices to Foil Gas Station Skimmers.” Business Blog, Federal Trade Commission, June 22, 2017.

U.S. Secret Service. n.d. “ATM and POS Terminal Skimming.” Accessed October 12, 2026.

Wireshark Foundation. n.d. “Display Filter Reference: Address Resolution Protocol.” Accessed October 12, 2026.