Network security is about protecting messages that travel between two trusting parties across a wire that a stranger can touch . Everything on this page is a tool for answering just three questions about any message: who sent it? (authentication), is it new? (freshness), and am I being drowned in fake work? (resource limits).
Before you can read the parent note Network security — DDoS, MITM, replay & countermeasures , you must be able to read its symbols on sight. This page builds each one from nothing, in an order where every idea rests only on the ones above it.
Picture a plain drawing. On the left, a person we call Alice . On the right, Bob . Between them a single line — the network wire . Sitting on that wire, able to see and touch everything crossing it, is Eve , the attacker.
Definition The characters
Alice / Bob — the two honest parties who want to talk. In the picture, the two people at the ends.Eve — the attacker who can read, copy, delete, or inject messages on the wire. Drawn sitting on the line, because she is literally in the middle of the medium.Message m SYN packet). Drawn as an arrow with a little envelope.
Every attack in the parent note is just Eve doing one of the things her position allows. We need symbols to describe what she does and how we stop her — that is the rest of this page.
The parent note throws around SYN, SYN-ACK, ACK, "half-open", "backlog". Here is where those come from.
A packet is one small labelled envelope of data. Its label always carries a source address ("who I claim to be from") and a destination address ("who I'm going to"). That's it — an envelope with a from-line and a to-line.
The from-line matters enormously: nothing on the basic network checks that the from-line is true. Writing a false from-line is called spoofing — the single trick behind SYN floods and reflection.
Definition The TCP three-way handshakeBefore two computers exchange data over TCP they perform a three-step greeting :
Client → Server: SYNsynchronize ).
Server → Client: SYN-ACK
Client → Server: ACKacknowledge ).
Full detail lives in Transport Layer — TCP three-way handshake .
Why the topic needs this: after step 2 the server has already written down who this half-finished connection is with, so it can recognise the ACK when it comes. That written-down note is called a half-open connection , and the shelf it sits on is the backlog queue . The whole SYN-flood attack is Eve filling that shelf with greetings she never finishes.
B T
B number of slots on the server's shelf for half-open connections. A fixed, finite number (say 128).T T keeps a slot before giving up on the missing ACK.
Picture B T
The SYN-flood formula reads λ ≥ B / T
λ λ rate : how many things happen per second. Attacker sending 5000 SYNs each second means λ = 5000 s − 1 λ
L W
L average number of items sitting inside the system right now (slots currently held).W average time each item stays inside (here W = T
c a c s
c a one attack packet costs the attacker (effort, bytes, memory).c s forces the server to spend .
Picture a see-saw: attacker's tiny weight on one side, server's huge forced weight on the other.
Common mistake The symbol≫ ∥
≫ ∥ concatenation : gluing two pieces of data end to end. m ∥ n m n
MITM and replay both hinge on keys . Here is the minimum vocabulary.
Definition Shared secret / keyK key K number both honest parties know but Eve does not . Picture an identical physical key held by Alice and Bob only. With it they can lock (encrypt) and prove-authorship (MAC) messages.
Definition Diffie–Hellman shared keyK 1 K 2 Diffie–Hellman key exchange while shouting across a public room — an eavesdropper hearing every word still can't compute it. The parent note writes
Alice K 1 Eve K 2 Bob , K 1 K 2 WHY it matters: DH gives secrecy but says nothing about who you agreed with — so Eve can sit in the middle running two agreements. That gap is the whole MITM section.
Definition MAC and the notationMAC K ( m ) Message Authentication Code is a short ==tag computed from a message m K MAC K ( m ) K m K K Message Authentication Codes (MAC) & HMAC .
It answers two questions at once: was this really from someone holding K and was it altered? — because changing even one bit of m
n T s
Nonce n — a number used once ("n umber used once "). Each fresh message carries a new n n Timestamp T s — the clock time the message was made . Accept only if it's recent, i.e. within a window Δ
Δ ∣ T now − T s ∣ ≤ Δ Δ tolerance — how stale we'll allow a message to be. The bars ∣ ⋅ ∣ absolute value : the size of the gap, ignoring sign, so a message from the future or the past is judged by distance from now. Picture a sliding time-window; only messages inside it are let through.
Why the topic needs all this: a replay attack resends a genuine, valid message. Encryption can't stop it — the copy still decrypts fine. Only a one-time ingredient (n T s n t = MAC K ( m ∥ n )
Definition Certificate & CAA certificate is a signed statement "this public key belongs to this name" issued by a trusted Certificate Authority (CA) . Picture a passport: a trusted office vouches that the photo (key) matches the person (domain). This is what turns unauthenticated DH into safe TLS handshake ; the trust chain is Public Key Infrastructure & Certificates .
r challenge r fresh random number the verifier sends ("prove you're live"). The response MAC K ( r ) K right now, for this r . Next time a new r
Packet with spoofable source
TCP handshake SYN SYN-ACK ACK
Little's Law L equals lambda W
Nonce n and timestamp T_s
Read each cue, answer aloud, then reveal.
What does a spoofed source address let an attacker do? Send packets that appear to come from someone else, so replies (or blame) go to a victim and the real sender is hidden.
State the TCP handshake in three words. SYN, SYN-ACK, ACK.
In λ ≥ B / T λ B T λ B T
Little's Law in one equation. L = λW
What does the amplification factor A = c s / c a Server cost burned per unit of attacker effort; A ≫ 1
What does m ∥ n Concatenation — the bytes of m n
What does MAC K ( m ) That the message came from someone holding key K
Why can't encryption alone stop a replay? A copied valid ciphertext still decrypts correctly; you need a one-time nonce or timestamp for freshness.
What does a nonce n That a message is used only once; the receiver keeps a "seen" set and rejects any repeated n
What does ∣ T now − T s ∣ ≤ Δ Messages whose timestamp is within Δ
What gap in plain Diffie–Hellman does a certificate fill? Authentication — it binds a public key to an identity, so you know who you agreed the secret with.
