Availability Attacks Without an Adversary: Evidence from Enterprise LANs
Fuente:
arXiv
Salvato in:
| Autori principali: | , , , , |
|---|---|
| Natura: | Preprint |
| Pubblicazione: |
2026
|
| Soggetti: | |
| Accesso online: | |
| Tags: |
Aggiungi Tag
Nessun Tag, puoi essere il primo ad aggiungerne!!
|
| _version_ | 1866910011122253824 |
|---|---|
| author | Paudyal, Rajendra Upadhyay, Rajendra Emran, Al Nahian Bin Donnan, Lisa Wijesekera, Duminda |
| author_facet | Paudyal, Rajendra Upadhyay, Rajendra Emran, Al Nahian Bin Donnan, Lisa Wijesekera, Duminda |
| contents | Denial-of-Service (DoS) conditions in enterprise networks are commonly attributed to malicious actors. However, availability can also be compromised by benign non-malicious insider behavior. This paper presents an empirical study of a production enterprise LAN that demonstrates how routine docking and undocking of user endpoints repeatedly trigger rapid recalculations of the control plane of the Rapid Spanning Tree Protocol (RSTP) [1]. Although protocol-compliant and nonmalicious, these events introduce transient forwarding disruptions of approximately 2-4 seconds duration that degrade realtime streaming (voice and video) services while remaining largely undetected by conventional security monitoring. We map this phenomenon to the NIST and MITRE insider threat frameworks, characterizing it as an unintentional insider-driven availability breach, and demonstrate that explicit edge-port configuration effectively mitigates the condition without compromising loop prevention |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2602_04216 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | Availability Attacks Without an Adversary: Evidence from Enterprise LANs Paudyal, Rajendra Upadhyay, Rajendra Emran, Al Nahian Bin Donnan, Lisa Wijesekera, Duminda Cryptography and Security Networking and Internet Architecture Denial-of-Service (DoS) conditions in enterprise networks are commonly attributed to malicious actors. However, availability can also be compromised by benign non-malicious insider behavior. This paper presents an empirical study of a production enterprise LAN that demonstrates how routine docking and undocking of user endpoints repeatedly trigger rapid recalculations of the control plane of the Rapid Spanning Tree Protocol (RSTP) [1]. Although protocol-compliant and nonmalicious, these events introduce transient forwarding disruptions of approximately 2-4 seconds duration that degrade realtime streaming (voice and video) services while remaining largely undetected by conventional security monitoring. We map this phenomenon to the NIST and MITRE insider threat frameworks, characterizing it as an unintentional insider-driven availability breach, and demonstrate that explicit edge-port configuration effectively mitigates the condition without compromising loop prevention |
| title | Availability Attacks Without an Adversary: Evidence from Enterprise LANs |
| topic | Cryptography and Security Networking and Internet Architecture |
| url | https://arxiv.org/abs/2602.04216 |