How can you reason about a network attack?

Classify the behavior

Start with impact and evidence.

Reconnaissance looks for information about hosts, services, or paths. Interception attempts to observe or alter communication. Saturation consumes capacity so legitimate users cannot obtain normal service. These categories can overlap, and a symptom does not prove intent.

Defensive analysis compares timing, source patterns, affected services, logs, packet captures, and changes from a known baseline. Preserve the original evidence and control access to it while the investigation continues.

Reduce exposure

A smaller attack surface gives defenders fewer surprises.

Disable unused services, restrict management access, require strong authentication, and apply rate limits where repeated requests can consume resources. These controls reduce opportunities without pretending that every unusual request is malicious.

Protection needs observation and a recovery path. A strict limit can block legitimate users, and an aggressive containment step can destroy evidence or interrupt a critical service. Prefer measured, reversible changes when the situation is still uncertain.

Build the model

Four defensive questions