Page 219 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
An OSPF router that must remain reachable but avoid transit advertises MaxLinkMetric on every non-stub link in its router-LSA. MaxLinkMetric is the 16-bit all-ones value 0xffff and signals that the advertised link should not carry transit traffic.
Read the explainer
A BGP Large Community is a 12-octet value containing a four-octet Global Administrator and two four-octet operator-defined local fields. The Global Administrator should be an ASN whose owner defines the two local fields; reserved ASNs are not recommended for that role.
Read the guide
BGP first assigns each feasible received route a policy-derived preference, then selects one best route per destination for the Loc-RIB. A route with an unresolvable NEXT_HOP is excluded from selection, and the chosen route is re-evaluated when next-hop reachability or IGP cost changes.
Read the playbook
An application using UDP should congestion-control the aggregate rate of every socket or worker sending to the same destination host.
Read the briefing
A carrier-grade NAT must support administrator-configurable per-subscriber external-port limits and should support configurable limits on mapping and subscriber state memory.
Read the checklist
Enhanced route-refresh procedures apply to a peer only after that peer has advertised the Enhanced Route Refresh Capability. The refreshing speaker must send Begin-of-RIB-Refresh before re-advertisement and End-of-RIB-Refresh after completing the entire affected Adj-RIB-Out.
Read the explainer
Canonical IPv6 text suppresses leading zeroes in each 16-bit field while representing a single all-zero field as 0. The double-colon form compresses the longest eligible zero run, never a single zero field, and selects the leftmost run when equal-length runs tie.
Read the guide
In a synchronized state, TCP resets only on an RST whose sequence exactly equals RCV.NXT; it discards an out-of-window RST and challenges an in-window nonmatching RST with an ACK before dropping it.
Read the playbook
Strict reverse-path forwarding accepts a source only when the packet arrived on the interface selected by the best forwarding path back to that source.
Read the briefing
An IPv6 unicast address identifies one interface, and traffic sent to it is delivered to that interface. An IPv6 anycast address identifies multiple interfaces and delivers a packet to the nearest one according to routing distance.
Read the checklist