What is sybil attack?

[blackstar02]

If an attacker attempts to fill the network with clients that they control, you would then be very likely to connect only to attacker nodes. Although Bitcoin never uses a count of nodes for anything, completely isolating a node from the honest network can be helpful in the execution of other attacks.

This state can be exploited in (at least) the following ways:

the attacker can refuse to relay blocks and transactions from everyone, effectively disconnecting you from the network
the attacker can relay only blocks that they create, effectively putting you on a separate network and then also leaving you open to double-spending attacks
if you rely on transactions with 0 confirmations, the attacker can just filter out certain transactions to execute double-spending attacks
low-latency encryption/anonymization of Bitcoin's transmissions (with Tor, JAP, etc.) can be defeated relatively easily with a timing attack if you're connected to several of the attacker's nodes and the attacker is watching your transmissions at your ISP
Bitcoin makes these attacks more difficult by only making an outbound connection to one IP address per /16 (x.y.0.0). Incoming connections are unlimited and unregulated, but this is generally only a problem in the anonymity case where you're probably already unable to accept incoming connections.

Looking for suspiciously-low network hash-rates may help prevent the second one.