Part 07 – Layer 3 Protocols and Attacks

As the title of this section implies, we look exclusively at the protocols at layer 3 and the multitude of threats targeting them. Layer 3 protocols are commonly referred to as the 'I' protocols, though this isn't completely accurate, it suffices for the scope of the CISSP exam. In addition to the IP addressing protocol at layer 3, there is the"IP Helper" protocol ICMP and its various messages that are used by networking diagnostic utilities such as ping and traceroute. We point out that this protocol and its associate messages remains a double-edged sword that is frequently exploited by attackers. We then go on to examine some of the major layer 3 protocol threats. We'll look at Loki attacks which create a convert channel for sneaking data through in the ICMP header. And no discussion of layer 3 threats would be complete without mentioning smurf and DDoS attacks utilizing spoofed ping requests. These may be shopworn attacks that savvy network admins thwart by blocking incoming ICMP messages and directed broadcasts, however, they are still quite prevalent and their impact is no less devastating to their hapless victims.