BPDB — Assistant Engineer (CSE) Written Test: 2018প্রশ্ন ও সমাধান

Device	OSI Layer	Function	Collision domain	Broadcast domain
Hub	Physical (L1)	Simply repeats/broadcasts every incoming signal out of all other ports — no intelligence.	One single collision domain for all ports	One single broadcast domain
Switch	Data Link (L2)	Learns MAC addresses per port and forwards frames only to the specific port the destination is on.	Each port is its own collision domain	One broadcast domain (unless VLANs are used)
Router	Network (L3)	Forwards packets between different networks based on IP addresses; makes routing decisions using a routing table.	Each port is its own collision domain	Each port/interface is its own broadcast domain

graph LR
    H["Hub: dumb repeater, 1 port to ALL ports"]
    S["Switch: MAC-address table, port to specific port"]
    R["Router: IP routing table, network to network"]

• Hub: cheapest, oldest, causes many collisions since every device shares one collision domain (half-duplex); mostly obsolete today.
• Switch: the standard LAN device today — full-duplex, dramatically reduces collisions by isolating each port, and can be VLAN-segmented for security/traffic control.
• Router: connects separate networks (e.g., a LAN to the Internet), performs NAT, and makes forwarding decisions using destination IP addresses rather than MAC addresses.

Exam takeaway: Hub = Layer 1 broadcast-to-all repeater; Switch = Layer 2 intelligent frame forwarding by MAC; Router = Layer 3 forwarding between distinct networks by IP.

Attack	What happens	Typical goal
DoS (Denial of Service)	Attacker floods a server/network with excessive or malformed requests, exhausting its bandwidth/resources so legitimate users cannot get service.	Disrupt availability
IP Address Spoofing	Attacker forges the source IP address field in packets, making traffic appear to come from a trusted/different host.	Hide identity, bypass IP-based filters, enable reflected DDoS
Man-in-the-Middle (MITM)	Attacker secretly intercepts (and can alter) communication between two parties who believe they are talking directly to each other.	Eavesdrop, steal credentials, inject malicious data

• DoS: floods a target with useless/invalid requests until it can no longer respond to real users; a DDoS (Distributed DoS) is the same attack launched from many compromised machines (a botnet) at once.
• IP Spoofing: by falsifying the source-IP header, attackers can mask their identity or trick a victim into sending reply traffic to a third party (used in reflection/amplification DDoS attacks). It works because IP itself has no built-in sender authentication.
• Man-in-the-Middle: the attacker positions itself between client and server (e.g., via ARP spoofing on a LAN, a rogue Wi-Fi access point, or DNS spoofing), silently relaying and possibly modifying traffic without either party noticing.

sequenceDiagram
    participant C as Client
    participant A as Attacker
    participant S as Server
    C->>A: Request (thinks it is going to Server)
    A->>S: Forwarded/altered request
    S->>A: Response
    A->>C: Forwarded/altered response

• Defense against MITM: TLS/SSL encryption + certificate validation, HSTS, VPNs on untrusted networks, and static ARP entries on critical LAN segments.
• Defense against IP spoofing: ingress/egress filtering (BCP38) at the router, and authentication mechanisms above the IP layer (e.g., IPsec).
• Defense against DoS: rate limiting, firewalls/IPS, and DDoS-mitigation/CDN services (e.g., traffic scrubbing).

Exam takeaway: DoS attacks availability by flooding; IP spoofing forges the sender's identity; MITM secretly sits between two communicating parties — encryption (TLS/IPsec) is the common defense against the latter two.