A packet leaving your laptop does not travel to its destination. It travels to the next machine that has agreed to carry it, and that machine decides what happens next. Every hop is a decision made by somebody else's equipment.
That is the first thing to hold onto, because almost every network attack is an abuse of a trust decision rather than a broken algorithm.
The layers, and what each one trusts
When your machine wants to reach a server it performs several separate acts of faith:
- ARP asks "who has this address?" on the local network and believes the first answer. There is no authentication in ARP at all.
- DNS turns a name into an address. Without DNSSEC, you believe whatever answer arrives first.
- BGP decides which path your traffic takes between networks. It works on announcements, and historically believed them.
- TLS is the one layer that does verify, and only that the certificate chains to a trusted authority.
Why this matters here
This desk publishes an advisory about the regional networks that have a single visible BGP neighbour. That is not an abstract concern. A network with one upstream has one decision-maker between it and the rest of the internet.
> A packet does not go where you send it. It goes where each hop decides to put it.
What to take away
When you look at any network problem, ask which component is trusting something it cannot verify. That question finds more real issues than any scanner.