Exploring Common Network Attack Vectors: Port Scanning, Denial-of-Service, and Man-in-the-Middle

Imagine you are walking through a busy city on a warm afternoon. You pass a row of office buildings, each one connected to the others by roads and footpaths. Each building has many doors — a main entrance for visitors, a side door for deliveries, a back door for staff only. Some doors are wide open. Some are locked. Some are hidden behind heavy gates. Now imagine a stranger walking slowly down that street, quietly trying each door handle, one by one, noting which ones open and which ones do not. That stranger is not stealing anything yet. They are simply gathering information. But what they learn from those door handles could help them plan something far more harmful later. This image is a very accurate picture of what happens on computer networks every day. The buildings are computers and servers. The roads are the cables and wireless signals that connect them. The doors are called ports — specific numbered entry points that allow different kinds of information to flow in and out. And the stranger trying the door handles is performing what cybersecurity professionals call a port scan. This lesson will take you deep into the world of three powerful and common network attack techniques: port scanning, Denial-of-Service attacks, and Man-in-the-Middle attacks. By the end, you will understand not only how they work, but why they matter to every person who uses the internet — which today means nearly everyone on earth. Let us begin with the city and its doors, because that picture will carry us through everything that follows. Every computer connected to a network has what are called ports. A port, in simple terms, is a numbered channel — a specific pathway through which a particular type of communication travels. Think of a large post office. Letters go through one window, packages through another, registered mail through a third. Each window has a number. On a computer, the number for ordinary web browsing is Port 80. Secure web browsing uses Port 443. Email uses Port 25. Remote control of a computer uses Port 22. There are 65,535 ports in total, each potentially carrying a different kind of traffic. When a service is running on a computer — say, a web server — it opens the relevant port and "listens," waiting for incoming communication, just like a shop owner who has unlocked the front door and is waiting for customers. Now, a port scan is the act of probing a computer's ports to find out which ones are open and what is running on them. The scanning tool sends a small message to each port, one after another, and waits to see what comes back. If the port is open, the computer responds in a way that says, in effect, "yes, there is something running here." If the port is closed, the response says "nothing here." And sometimes there is no response at all, which usually means a firewall — a security system that controls what traffic is allowed through — is blocking the probe entirely. To understand why this matters, consider the story of WannaCry, one of the most destructive cyberattacks in modern history, which struck in May 2017. WannaCry was a piece of ransomware — that is, a type of malicious software that locks a victim's files and demands payment to unlock them. Before WannaCry could infect a machine, the attackers needed to find vulnerable machines. They did this using automated port scanners that swept the entire internet looking for computers with Port 445 open. Port 445 is used by Windows computers for file sharing. At the time, many computers running older versions of Windows had a serious weakness in the software behind Port 445, a weakness known as EternalBlue. The scan itself did nothing harmful. It simply created a map. But that map told the attackers exactly where to aim, and the attack that followed affected more than 200,000 computers across 150 countries, including the UK's National Health Service, which had to cancel thousands of medical appointments as a result. The most widely used port scanning tool in the world is called Nmap, which stands for Network Mapper. It is important to understand that Nmap is not a weapon created by criminals. It is a legitimate, professional tool used daily by network administrators — the people responsible for keeping computer networks safe — to check their own systems for weaknesses. Using Nmap on your own network is like a homeowner walking around their own house checking every door and window lock. The same tool used by a criminal to scout someone else's building becomes a very different thing. This is why the ethics and legality of port scanning are genuinely debated. In most countries, scanning a network that you do not own or have permission to scan is illegal, even if you cause no direct harm. The act of gathering information about someone else's system without permission is itself considered an intrusion. There are several different methods of scanning, and they differ mainly in how much noise they make. The simplest is called a TCP Connect Scan. TCP stands for Transmission Control Protocol, which is the main set of rules — or protocol — that governs how data travels reliably across the internet. To establish a connection, two computers perform what is called a three-way handshake. Think of it like a formal introduction: the first computer sends a signal that says "I would like to connect" (this is called a SYN packet, short for synchronize). The second computer replies "I agree, let us connect" (a SYN-ACK packet, meaning synchronize-acknowledge). The first computer then confirms with "understood, we are now connected" (an ACK packet, meaning acknowledge). A TCP Connect Scan completes this entire handshake on every port it probes. It works reliably, but because the full connection is made, it is easily detected and logged by the target computer's security systems. It is, in our city analogy, the equivalent of actually walking up to each door, knocking loudly, and waiting for an answer — easy to notice. A stealthier version is called a SYN Scan, sometimes called a half-open scan. Here, the scanner sends the first SYN signal to start the handshake. If the port is open, the target replies with SYN-ACK. But instead of completing the connection with an ACK, the scanner immediately sends a RST signal — short for reset — which abruptly breaks off the exchange before the connection is fully formed. Because the connection is never completed, many older logging systems never record it. It is the equivalent of knocking on the door and then stepping out of sight before it opens, just long enough to hear whether anyone was home. Modern security systems can still detect this technique, but it remains more discreet than a full connect scan. There is also a UDP Scan. UDP stands for User Datagram Protocol, which is a different, less formal set of communication rules. Unlike TCP, it does not require a handshake. It just sends data and does not wait for confirmation that it arrived. Scanning UDP ports is trickier because of this. The scanner sends a message to a UDP port. If the port is closed, the computer usually sends back an error message. If nothing comes back, the port is assumed to be open or possibly blocked by a firewall. It is less certain and slower, like trying to figure out if someone is home by leaving a note under the door and waiting to see if they respond. The key lesson about port scanning is this: by itself, it does no damage. But it is the reconnaissance step — the careful observation before action — that precedes many serious attacks. A bank robber who studies the guards' patrol routes, the location of cameras, and the timing of deliveries is not yet committing a crime. But that knowledge is what makes the robbery possible. Port scanning is the digital equivalent of that preparation. Now let us move from reconnaissance to destruction. If port scanning is quietly casing the building, a Denial-of-Service attack is throwing so many people at the building's entrance that nobody can get in or out. A Denial-of-Service attack — usually shortened to DoS — is an attempt to make a computer service unavailable to the people who legitimately need it, not by breaking in, but by overwhelming it. Imagine a small coffee shop with one counter and one server. On a normal day, ten customers come in per hour and service runs smoothly. Now imagine someone sends 10,000 people to stand in line simultaneously, none of whom intend to buy anything. The shop does not need to be robbed or damaged. It simply cannot function. The real customers cannot get through the crowd. That is a DoS attack. The goal is disruption, not theft. A single attacker with a single computer sending traffic is limited in how much damage they can do. But what happens when an attacker controls not one computer, but hundreds of thousands? This is what makes the Distributed Denial-of-Service attack — a DDoS attack — so powerful and so frightening. The word distributed here means the attack comes from many different places at once. To understand how an attacker gets control of hundreds of thousands of devices, we need to understand the concept of a botnet. A botnet is a network of computers or devices that have been infected with malicious software — malware — and can be remotely controlled by an attacker without the owners knowing. The individual devices in a botnet are sometimes called "zombies," because they appear to function normally for their owners while secretly doing the attacker's bidding. A homeowner might have a smart security camera in their living room that, unbeknownst to them, is also a soldier in someone else's digital army. This brings us to one of the most striking real-world examples of a DDoS attack: the 2016 attack on a company called Dyn. To appreciate why this attack was so devastating, you need to understand what Dyn did. Dyn was a DNS provider. DNS stands for Domain Name System, and it is sometimes called the internet's phonebook. When you type "www.google.com" into your browser, your computer does not actually know where that is. It needs to look up the numerical address — called an IP address — that corresponds to that name, much like looking up a person's phone number in a directory. DNS servers perform this lookup billions of times per day. If those servers go down, the internet does not break technically, but it becomes largely unusable for ordinary people, because they cannot translate the names they type into the addresses their computers need. In October 2016, attackers directed the Mirai botnet at Dyn's servers. The Mirai botnet was remarkable because it was composed almost entirely of Internet of Things devices — the collective term for everyday objects that connect to the internet, such as digital cameras, digital video recorders, baby monitors, and home routers. Mirai had infected these devices by simply trying common default usernames and passwords — combinations like "admin/admin" or "root/password" that many manufacturers set at the factory and that most users never change. The botnet consisted of hundreds of thousands of such devices. When they all sent traffic to Dyn simultaneously, the company's servers were overwhelmed. The result was that major websites including Twitter, Netflix, Reddit, Spotify, PayPal, and The New York Times became inaccessible for hours across large parts of North America and Europe. Millions of people were cut off from services they relied on, and businesses lost significant amounts of money. The technical methods behind DDoS attacks generally fall into three broad categories. The first is a volumetric attack, which is the most straightforward. The botnet simply sends so much data — so many packets of information — that the target's internet connection is completely saturated. Think of trying to drive to a building when the roads leading to it are completely jammed with cars that are going nowhere. The building is still there. Nothing is broken. But nobody can reach it. The second category is called a protocol attack. These exploit weaknesses in the rules governing how internet communication works. A well-known example is the SYN flood. Remember the three-way handshake? In a SYN flood, the attacker sends millions of SYN packets — "I would like to connect" — to the target server. The server dutifully replies with SYN-ACK to each one, reserves some of its memory to wait for the final ACK, and waits. But the ACK never comes. The server sits there, memory tied up in thousands of half-open connections that will never be completed, until it runs out of resources and can no longer accept any new, legitimate connections. It is like a receptionist who receives 10,000 phone calls, puts them all on hold waiting for the caller to confirm something, and then has no capacity to answer any new calls or attend to people who walk through the door. The third category is the application layer attack, which is more subtle and in some ways more dangerous. Rather than flooding a server with raw traffic, these attacks send requests that look completely legitimate but are extremely expensive for the server to process — for example, search queries designed to force the database to do enormous amounts of work. Because these requests appear genuine, they are harder to filter out. A small number of them can cause as much disruption as a flood of obvious garbage traffic. Defending against DDoS attacks is a significant industry in itself. Specialized services provided by companies such as Cloudflare, Akamai, and Amazon Web Services can absorb enormous amounts of attack traffic and filter it before it reaches the target. Think of these services as hiring thousands of security staff to stand outside your building and turn away anyone who is clearly not there for a legitimate purpose, even while the crowd surges. Rate limiting — a technique that restricts how many requests a single address can make in a given period — can help with application layer attacks. But as the Mirai botnet showed, when the attack comes from hundreds of thousands of different addresses, filtering becomes extremely difficult. The deeper question raised by DDoS attacks is one of responsibility. When the Mirai botnet attacked Dyn, the "weapons" used were ordinary people's home cameras and routers. Those device owners had done nothing intentionally wrong. The manufacturers who shipped devices with weak, unchangeable default passwords bore significant responsibility. The internet service providers whose networks carried the attack traffic could arguably have done more to filter it. This is a genuinely contested question, and experts continue to debate where the greatest responsibility lies. Now we turn to the third attack vector, which is perhaps the most subtle and unsettling of all. Port scanning is reconnaissance. A DoS attack is a blockade. A Man-in-the-Middle attack is something entirely different — it is impersonation and interception. It is the digital equivalent of a dishonest postal worker who opens your letters, reads them, and then carefully reseals the envelopes before delivering them, so that neither the sender nor the recipient ever knows the mail was read. A Man-in-the-Middle attack — usually abbreviated as MitM — occurs when an attacker secretly inserts themselves between two parties who believe they are communicating directly with each other. From this position, the attacker can read the conversation, copy sensitive information such as passwords, bank details, or private messages, and even change the content of the messages without either party realizing it. To understand how an attacker gets into this position, consider what happens when you use a coffee shop's free Wi-Fi. Your laptop connects to the coffee shop's router, and the router connects to the internet. All your data passes through that router. Now imagine an attacker in the same coffee shop sets up their own fake Wi-Fi access point — a device broadcasting a network with an innocuous-sounding name like "CoffeeShop_FreeWifi." If you connect to the attacker's fake network instead of the real one, all your data flows through their machine first. They can see everything. This technique is called an Evil Twin access point, because the fake network mimics the appearance of a real one. Another common MitM technique is called ARP Spoofing. ARP stands for Address Resolution Protocol, and it is a system that computers on a local network use to find each other. Every device on a network has both a numerical IP address and a physical hardware address called a MAC address. ARP is how a device translates an IP address into the corresponding MAC address so it knows exactly where to send data. In ARP spoofing, the attacker sends forged messages across the local network, claiming that their own machine's MAC address corresponds to the IP address of the router. Other devices on the network update their records and start sending all their outgoing internet traffic to the attacker's machine by mistake, believing it to be the gateway to the internet. The attacker then passes that traffic along to the real router — so everything appears to work normally — while reading everything in between. A third method is DNS Spoofing. Remember the internet's phonebook? In DNS spoofing, the attacker corrupts a DNS server's records so that when you type the address of your bank's website, the lookup returns the attacker's IP address instead of the real one. You are taken to a website that looks exactly like your bank — same colors, same logo, same layout — but is actually a fake, controlled by the attacker. When you type in your username and password, you are handing them directly to the criminal. This technique of creating a convincing fake website is also closely related to what security professionals call phishing, though DNS spoofing is technically more sophisticated because it can happen even if you type the correct address perfectly. One of the most striking and troubling real-world examples of a Man-in-the-Middle attack did not come from criminals at all. It came from a computer manufacturer. In 2015, security researchers discovered that a company called Lenovo — one of the world's largest manufacturers of laptop computers — had been pre-installing software called Superfish on some of its consumer laptops. Superfish was a piece of advertising software whose purpose was to inject targeted advertisements into users' web browsing — meaning it would add ads to web pages that the website itself had not put there. To do this on secure, encrypted websites, Superfish had to perform a Man-in-the-Middle attack on the user's own machine. Here is why this is technically significant. Most websites today use HTTPS, where the S stands for Secure. HTTPS uses a system of encryption — a method of scrambling data so that only the intended recipient can read it — based on what is called SSL/TLS, a set of security protocols. These protocols work through a system of trust: a website proves it is genuine by presenting a digital certificate, a kind of official credential, signed by a trusted authority. Your browser checks this certificate and, if it is valid, allows the encrypted connection. This chain of verification is what keeps a MitM attacker from simply reading your secure banking traffic. Superfish bypassed this entire system by installing its own root certificate — a master credential that overrides all others — onto the laptop. With this in place, Superfish could intercept even encrypted HTTPS traffic, decrypt it, insert its advertisements, re-encrypt it, and pass it along. The user would see the padlock symbol in their browser and believe their connection was secure, but the software on their own machine was reading everything. This was alarming enough on its own. But the situation became catastrophic when security researchers discovered that the private key — the secret code that the certificate was based on — was identical on every single Lenovo laptop with Superfish installed. This meant that once one researcher cracked the key, which took only a few hours, any malicious attacker could use it to perform real Man-in-the-Middle attacks on the millions of Lenovo users who had this software, intercepting their banking sessions, email accounts, and more. Lenovo quickly released a removal tool and apologized, but the incident revealed something deeply troubling: the security of our encrypted communications depends on a chain of trust, and that chain can be broken by the very companies we trust with our hardware. The Superfish case raises a question that goes beyond the technical and into the ethical and legal. Encryption systems like HTTPS are specifically designed to prevent eavesdropping by third parties. They protect our private communications, our financial information, and our personal data. When a company undermines that system — even for the relatively mundane commercial purpose of showing advertisements — they create vulnerabilities that criminals can exploit. The intent to harm and the capability to cause harm are two very different things, and Lenovo's actions showed that well-intentioned commercial decisions can create serious security risks for millions of people. The most effective defense against Man-in-the-Middle attacks is strong encryption, used consistently. The HTTPS padlock in your browser is meaningful protection, provided the underlying certificate infrastructure has not been compromised as in the Superfish case. Using a VPN — a Virtual Private Network, which is a service that creates an encrypted tunnel between your device and a server you trust, protecting all your traffic from anyone who might be watching on your local network — is particularly valuable on public Wi-Fi. Being alert to certificate warnings — those messages your browser shows when it cannot verify a website's identity — is also important. These warnings are easy to dismiss as annoying interruptions, but they sometimes indicate that something is genuinely wrong in the chain of trust. It is worth noting that all three of these attack vectors are connected in a larger chain. In a sophisticated targeted attack, an attacker might begin with port scanning to map a network and identify vulnerable services. They might then use a Man-in-the-Middle technique to intercept credentials and gain deeper access to the network. And they might use a DDoS attack as a distraction — flooding a company's web servers with traffic to occupy the security team while a quieter, more focused infiltration happens elsewhere. Real-world attacks are rarely just one technique in isolation. They are combinations, layered and sequenced, each step building on the information or access gained from the previous one. There is also the question of attribution — that is, figuring out who is actually responsible for an attack. This is far harder than it might seem. An attacker can route their scanning or attack traffic through multiple other compromised computers, so that tracing the traffic back to its origin is like following a trail of footsteps that deliberately leads into a river. Botnets, by definition, involve machines controlled remotely and owned by innocent people. A DDoS attack launched from 300,000 hacked cameras does not tell you who gave the command, only whose cameras were used. This difficulty of attribution has serious consequences at the international level: governments and security agencies regularly disagree about who was behind major attacks, and accusations of state-sponsored hacking — hacking conducted or encouraged by a national government — are often based on evidence that is strong but not conclusive. These are genuinely contested claims, and it is important to treat them with appropriate uncertainty. Finally, the field of cybersecurity is not static. The techniques described here are foundational, but they evolve continuously. There is serious discussion among security researchers about how artificial intelligence will change the landscape. AI systems could potentially be used to make DDoS botnets far more adaptive, able to shift their attack patterns faster than human defenders can respond. AI could automate the analysis of port scan results to identify vulnerabilities far more quickly than any human could. On the defensive side, AI is already being used to detect unusual patterns in network traffic that might indicate an attack in progress. The race between attack and defense is ongoing and accelerating. Understanding these techniques — port scanning, Denial-of-Service attacks, and Man-in-the-Middle attacks — is not just knowledge for professional cybersecurity experts. It is knowledge for anyone who uses the internet, which means anyone who shops online, banks online, communicates with friends and family online, or relies on digital services for their health, safety, or livelihood. When you choose to use HTTPS websites rather than HTTP ones, when you think twice before connecting to an unfamiliar Wi-Fi network, when you update the password on your home router or smart device, you are participating in the collective effort to make the internet a safer place. The attacks we have discussed in this lesson are not abstract threats that only affect large corporations. They affect individuals every day. And while the technical details can seem complex, the fundamental principles — do not leave doors unlocked, do not let your systems be overwhelmed, and do not let anyone intercept your private conversations — are principles that translate directly into everyday habits and decisions. To bring everything together: in this lesson, we explored three foundational ways that attackers target computer networks. Port scanning is a reconnaissance technique where an attacker probes a computer's numbered entry points to find out which ones are open and what services are running on them. It is not destructive by itself, but it is the critical first step that reveals where vulnerabilities exist, as illustrated by the WannaCry attack in 2017. Denial-of-Service attacks, and their more powerful form the Distributed Denial-of-Service attack, aim to make a service unavailable by overwhelming it with traffic or by exhausting its resources. The 2016 Dyn attack showed how hundreds of thousands of insecure consumer devices can be weaponized into a botnet capable of disrupting large portions of the internet for millions of people. Man-in-the-Middle attacks are stealthy interception attacks where an attacker secretly positions themselves between two communicating parties, reading or altering their communications without either side knowing. Techniques include fake Wi-Fi access points, ARP spoofing, and DNS spoofing, and the Lenovo Superfish case showed that such vulnerabilities can even be introduced by trusted manufacturers. Defenses exist for all three: firewalls and intrusion detection systems for port scanning; DDoS mitigation services and rate limiting for volumetric attacks; and strong encryption, VPNs, and careful attention to certificate warnings for Man-in-the-Middle threats. The most important lesson of all is that security is not a product to be bought once and forgotten. It is a continuous practice, shaped by awareness, updated knowledge, and the everyday choices of ordinary people.