This article investigates the implementation specifics of common network attacks that exploit vulnerabilities within the TCP/IP protocol stack - a critical infrastructural foundation of global network interaction. A comprehensive analysis is conducted on the architectural limitations and functional-protocol characteristics of key components of the network stack (ARP, IP, ICMP, TCP, UDP, DNS), which currently serve as primary vectors for the initiation of cyber threats. Based on the OSI reference model, a formalized classification of attacks by interaction layers is proposed, with emphasis on representative scenarios including IP spoofing, ARP poisoning, TCP session hijacking, DNS cache poisoning, UDP flooding, and ICMP-based covert channels. Typical mechanisms for bypassing traditional security tools have been identified, including route manipulation, alteration of control messages, and encapsulation of malicious packets within legitimate traffic. Special attention is given to the overview of tools and proactive threat detection techniques, including intrusion detection systems (IDS), firewalls, deep packet inspection (DPI) technologies, as well as behavioral and entropy-based anomaly analysis methods in network flows. The findings provide both a theoretical foundation for modeling attacks and assessing risks, and a practical basis for enhancing information security in heterogeneous network environments.
Kostiuk et al. (Wed,) studied this question.